Omega Products CN8200 Installation Manual

Using the MODBUS

Protocol with Omega

CN8200, CN8240, and CN8260

Controllers

OmegaÒ and Multi-Commä are trademarks of Omega.

MODBUSÒ is a trademark of AEG Schneider Automation, Inc.

Platinelä is a trademark of Engelhard Minerals & Chemical Corporation.

Table of Contents

1. Introduction.............................................................................................. 2-1

1.1 About This Manual ............................................................................................ 2-1

1.2 About Omega’s Implementation of the MODBUS Protocol .............................. 2-2

1.2.1 MODBUS Function Codes Supported ....................................................... 2-2

1.2.1.1 Functions to Access the Controller Databases ...................................... 2-2

1.2.1.2 What Happens if the Controller Can Do What the MODBUS Master

Tells It to Do........................................................................................ 2-2

1.2.1.3 What Happens if the Controller Cannot Do What the MODBUS Master

Tells It to Do........................................................................................ 2-3

1.2.1.4 Diagnostic Function ................................................................................ 2-3

1.2.2 MODBUS Transmission Mode Supported ................................................. 2-3

1.2.3 Baud Rates Supported............................................................................... 2-4

1.2.4 Serial Data Formats Supported by the Controllers.................................... 2-4

1.2.5 Addresses Supported by the Controllers................................................... 2-4

1.2.6 Data Types Used by Controllers................................................................ 2-5

1.2.6.1 Principle.................................................................................................. 2-5

1.2.6.2 Examples................................................................................................ 2-5

1.2.6.3 How These Data Types Are Transmitted in MODBUS Registers.......... 2-5

1.2.7 IEEE Register Ordering ............................................................................. 2-6

1.2.7.1 Principle.................................................................................................. 2-6

1.2.7.2 Example ................................................................................................. 2-6

1.2.8 Timing and Latency Issues ........................................................................ 2-7

1.2.8.1 Separating Messages............................................................................. 2-7

1.2.8.2 Allowing the Controller Time to Process a Request............................... 2-7

1.2.8.3 Applying the Timing Requirements ........................................................ 2-7

1.2.8.4 Example ................................................................................................. 2-8

1.3 Preparing Controllers for Use with MODBUS ................................................... 2-9

1.3.1 Introduction ................................................................................................ 2-9

1.3.2 MODBUS Communication Option ............................................................. 2-9

1.3.3 Assigning a Unique Controller ID............................................................... 2-9

1.3.4 Configuring the Controller Communication Parameters to Match the

MODBUS Master..................................................................................... 2-10

1.3.4.1 Communication Defaults ...................................................................... 2-10

1.3.4.2 Methods of Changing the Controller Configuration Parameters .......... 2-11

1.3.4.3 Example of Changing the Controllers’ Communication Parameter

Values Using MODBUS Messages .................................................... 2-11

1.4 Importance of Sequence in Which Configuration Parameters Are Written..... 2-13

1.5 Numbering Conventions Used in This Manual ............................................... 2-14

900M062U00 Ó Omega. i

Using MODBUS with Series C Controllers

2. MODBUS Functions Supported.............................................................. 3-1

2.1 Overview ........................................................................................................... 3-1

2.2 Function 03 ($03): Read One or More Holding Registers ................................ 3-2

2.2.1 Introduction ................................................................................................ 3-2

2.2.2 Allowable Number of Words to Be Read in a Function 03 Request .......... 3-2

2.2.3 Function 03 Request.................................................................................. 3-3

2.2.4 Function 03 Examples ............................................................................... 3-3

2.2.5 Function 03 Normal Reply ......................................................................... 3-3

2.2.6 Reply to Function 03 Request Containing Illegal Register Address:

02 ($02) Error Code ................................................................................ 3-4

2.2.7 Circumstances Under Which No Reply Is Sent in Response to a

Function 03 Message.............................................................................. 3-5

2.3 Function 06 ($06): Write to a Single Holding Register...................................... 3-5

2.3.1 Introduction ................................................................................................ 3-5

2.3.2 Function 06 Request.................................................................................. 3-5

2.3.3 Examples ................................................................................................... 3-6

2.3.4 Function 06 Normal Reply ......................................................................... 3-6

2.3.5 Reply to Function 06 Request Containing Illegal Register Address:

02 ($02) Error Code ............................................................................... 3-6

2.3.6 Reply to Function 06 Request Containing Illegal Value in Data Field:

03 ($03) Error Code ............................................................................... 3-7

2.3.7 Circumstances Under Which No Reply Is Sent in Response to a

Function 06 Message............................................................................. 3-7

2.4 Function 16 ($10): Write to Multiple Registers.................................................. 3-8

2.4.1 Introduction ................................................................................................ 3-8

2.4.2 Function 16 ($10) Request ........................................................................ 3-8

2.4.3 Allowable Number of Words to Be Written in Function 16 ($10)

Request ................................................................................................... 3-8

2.4.4 Function 16 ($10) Examples...................................................................... 3-9

2.4.5 Function 16 ($10) Normal Reply.............................................................. 3-10

2.4.6 Reply to Function 16 ($10) Request Containing Illegal Register

Address: 02 ($02) Error Code ................................................................ 3-10

2.4.7 Reply to Function 16 ($10) Request Containing Illegal Value in Data

Field: 03 ($03) Error Code ..................................................................... 3-11

2.4.8 Circumstances Under Which No Reply Is Sent in Response to a

Function 16 ($10) Request..................................................................... 3-11

2.5 Function 08 ($08): Loopback Test .................................................................. 3-12

2.5.1 Introduction .............................................................................................. 3-12

2.5.2 Function 08 Request................................................................................ 3-12

2.5.3 Function 08 Example ............................................................................... 3-12

2.5.4 Function 08 Normal Reply ....................................................................... 3-13

2.5.5 Circumstances Under Which No Reply Is Sent in Response to a

Function 08 Request ............................................................................... 3-13

ii Ó Omega. 900M062U00

Table of Contents

3. MODBUS Register Ranges and Data Types Used by Omega............... 4-1

3.1 Introduction ....................................................................................................... 4-1

3.2 Types of Values Used by the Controllers ......................................................... 4-1

3.2.1 Overview .................................................................................................... 4-1

3.2.2 Examples ................................................................................................... 4-1

3.3 How the Controller Stores Values That Are Always Integers ........................... 4-2

3.3.1 Principle ..................................................................................................... 4-2

3.3.2 What Is Displayed on the Controller Front Panel ...................................... 4-2

3.4 How the Controller Stores Values That Can Include Fractional Values ........... 4-3

3.4.1 Principles ................................................................................................... 4-3

3.4.2 What Is Displayed on the Controller Front Panel ...................................... 4-3

3.5 Using MODBUS to Transmit Controller Values That Are Always Integers:

3.5.1 Principles ................................................................................................... 4-5

3.5.2 Examples ................................................................................................... 4-5

3.6 Overview of Using MODBUS to Transmit Controller Values That Can Include

Fractional Values ........................................................................................... 4-6

3.6.1 Three Register Ranges Available .............................................................. 4-6

3.6.2 Which Region to Use ................................................................................. 4-6

3.6.2.1 First Choice for All Parameters and All Input Types: IEEE Floating

Point Region 8000 to 9999 .................................................................. 4-6

3.6.2.2 Second Choice with Temperature Inputs: 10X Region 1000 to 1999.... 4-7

3.6.2.3 Second Choice with Linear Inputs: Base Region 0000 to 0999............. 4-7

3.7 Base Fractional Value Region: Register Addresses 0000 to 0999................... 4-8

3.7.1 General Principles...................................................................................... 4-8

3.7.1.1 Introduction............................................................................................. 4-8

3.7.1.2 Base Region Uses One Register Per Value Transmitted ...................... 4-8

3.7.1.3 Range of Values That Can Be Transmitted in Base Region.................. 4-8

3.7.1.4 If Controller Is Configured to Support Decimal Places, Then the Controller’s Storage Method for a Parameter Affects Values Read

and Written .......................................................................................... 4-8

3.7.2 Interpreting Fractional Values Stored with the Decimal Point

Transmitted in Base Region 0000 to 0999.............................................. 4-9

3.7.2.1 Principles................................................................................................ 4-9

3.7.2.2 Examples................................................................................................ 4-9

3.7.3 Interpreting Fractional Values Stored Without Decimal Point

Transmitted in Base Region 0000 to 0999.............................................. 4-9

3.7.3.1 Principles................................................................................................ 4-9

3.7.3.2 Examples.............................................................................................. 4-10

3.8 10X Mirror of Base Fractional Value Region: Register Addresses

1000 to 1999 .................................................................................................. 4-11

3.8.1 Introduction .............................................................................................. 4-11

3.8.2 General Principles.................................................................................... 4-11

3.8.2.1 10X Region Uses One Register Per Value Transmitted ...................... 4-11

900M062U00 Ó Omega. iii

Using MODBUS with Series C Controllers

3.8.2.2 If Controller Is Configured to Support Decimal Places, Then the Controller’s Storage Method for a Parameter Affects Values Read

and Written ........................................................................................ 4-11

3.8.2.3 Relative Addresses in 10X Region Are 1000 More Than the

Corresponding Address in the Base Region ...................................... 4-12

3.8.2.4 Because of Range Limits, the 10X Region Not Recommended for FV

3.8.3 Interpreting Fractional Controller Values Stored With Decimal Point

Transmitted in the 10X Region 1000 to 1999 ......................................... 4-12

3.8.3.1 Principles.............................................................................................. 4-12

3.8.3.2 Examples.............................................................................................. 4-13

3.8.3.2.1 Reading an FV* Parameter with Temperature Input ....................... 4-13

3.8.3.2.2 Reading an FV Parameter ............................................................... 4-13

3.8.3.2.3 Writing to an FV Parameter ............................................................. 4-14

3.8.4 Interpreting Fractional Controller Values Stored Without Decimal

Point Transmitted in the 10X Region 1000 to 1999 ................................ 4-15

3.8.4.1 Principles.............................................................................................. 4-15

3.8.4.2 Examples.............................................................................................. 4-16

3.8.4.2.1 Reading an FV* Parameter from a Controller with a Linear Input –

Range Not Exceeded.................................................................... 4-16

3.8.4.2.2 Writing an FV* Parameter to a Controller with a Linear Input –

Range Not Exceeded.................................................................... 4-16

3.8.4.2.3 Reading an FV* Parameter from a Controller with a Linear Input –

Range Exceeded .......................................................................... 4-17

3.9 32-bit IEEE Mirror of Base Fractional Value Region: Register Addresses

8000 to 9999 ................................................................................................ 4-18

3.9.1 General Principles.................................................................................... 4-18

3.9.1.1 Introduction........................................................................................... 4-18

3.9.1.2 32-Bit IEEE Region Uses Two Registers Per Value Transmitted........ 4-18

3.9.1.3 Range of Values That Can Be Transmitted in the 32-Bit IEEE Region 4-18

3.9.1.4 If the Controller Is Configured to Use Decimal Places, Then the Controller’s Storage Method for a Parameter Affects Values Read

and Written ........................................................................................ 4-18

3.9.1.5 32-Bit IEEE Region Allows You to Configure the Controller to Use

Values with More Than Four Digits ................................................... 4-19

3.9.1.6 Relative Addresses in 32-Bit IEEE Region Can Be Calculated from

the Relative Address of a Parameter in the Base Region................. 4-19

3.9.1.7 A MODBUS Command to Transmit a Value Using the 8000 to 9999

Region Always Addresses an Even-Numbered Relative Address .... 4-19

3.9.1.8 Sequence in Which the Two Registers for a 32-Bit IEEE Value

Will Be Transmitted ............................................................................ 4-20

3.9.2 Interpreting Fractional Controller Values Stored With Decimal Point

Transmitted in the 32-Bit IEEE Region 8000 to 9999 ............................ 4-20

3.9.2.1 Principles.............................................................................................. 4-20

3.9.2.2 Examples.............................................................................................. 4-20

3.9.2.2.1 Reading an FV* Parameter with Temperature Input...................... 4-20

3.9.2.2.2 Reading an FV Parameter .............................................................. 4-21

* Parameters When a Linear Input Is Used ............................. 4-12

iv Ó Omega. 900M062U00

Table of Contents

3.9.2.2.3 Writing to an FV Parameter ............................................................ 4-21

3.9.3 Interpreting Fractional Controller Values Stored Without Decimal

Point Transmitted in the 32-Bit IEEE Region 8000 to 9999 ................... 4-21

3.9.3.1 Principles.............................................................................................. 4-21

3.9.3.2 Examples.............................................................................................. 4-22

3.9.3.2.1 Reading an FV* Parameter from a Controller with a Linear Input . 4-22

3.9.3.2.2 Writing an FV* Parameter to a Controller with a Linear Input........ 4-23

3.10 Summary......................................................................................................... 4-24

3.10.1.1 Regions of the MODBUS Register Map Used to Transmit Controller

Values.............................................................................................. 4-24

3.10.2 Parameters That Use Integer Values Only .............................................. 4-25

3.10.3 Parameters for Which the Controller Can Use a Fractional Value .......... 4-25

3.10.3.1 Three Regions Available .................................................................. 4-25

3.10.3.2 Special Cases: the Significance of the FV and FV* Notations ........ 4-26

4. Omega MODBUS Register Addresses Arranged by Parameter

Function................................................................................................ 5-1

4.1 Introduction ....................................................................................................... 5-1

4.1.1 Importance of Writing Configuration Parameters in Correct Sequence .... 5-1

4.1.2 Arrangement of the Parameters and Other Values in This Section .......... 5-2

4.1.3 Information Provided in Each Subsection.................................................. 5-3

4.1.3.1 Subsection Introduction.......................................................................... 5-3

4.1.3.2 Register Table ........................................................................................ 5-3

4.1.3.3 Linear Inputs Affect Range of Valid Values............................................ 5-4

4.1.3.3.1 If Range Is “Sensor Low to Sensor High”, Input Scaling

Limits Apply..................................................................................... 5-4

4.1.3.3.2 If Decimal Position Is Non-Zero, Range Is Reduced ........................ 5-5

4.1.4 Calculating Register Addresses for Parameters That Use Fractional

Values ...................................................................................................... 5-6

4.1.4.1 Principles................................................................................................ 5-6

4.1.4.2 Example ................................................................................................. 5-6

4.2 Communication Parameters ............................................................................. 5-7

4.2.1 Overview .................................................................................................... 5-7

4.2.2 Communication Parameter Registers ........................................................ 5-7

4.3 Input Parameters .............................................................................................. 5-8

4.3.1 Overview .................................................................................................... 5-8

4.3.2 Input Parameter Registers......................................................................... 5-8

4.4 Display Parameters......................................................................................... 5-10

4.4.1 Overview .................................................................................................. 5-10

4.4.2 Display Parameter Registers ................................................................... 5-10

4.5 Output Parameters.......................................................................................... 5-11

4.5.1 Overview .................................................................................................. 5-11

4.5.2 Output Parameter Registers .................................................................... 5-12

4.6 Control Parameters ......................................................................................... 5-15

4.6.1 Overview .................................................................................................. 5-15

4.6.2 Control Parameter Registers ................................................................... 5-15

900M062U00 Ó Omega. v

Using MODBUS with Series C Controllers

4.7 Alarm Parameters ........................................................................................... 5-17

4.7.1 Overview .................................................................................................. 5-17

4.7.2 Alarm Parameter Registers ..................................................................... 5-17

4.8 Autotune Damping Parameter ........................................................................ 5-19

4.8.1 Overview .................................................................................................. 5-19

4.8.2 Autotune Damping Parameter Register................................................... 5-19

4.9 Ramp/Soak Parameters.................................................................................. 5-20

4.9.1 Overview .................................................................................................. 5-20

4.9.2 Ramp/Soak Parameter Registers ............................................................ 5-21

4.10 Parameters for Options ................................................................................... 5-23

4.10.1 Overview .................................................................................................. 5-23

4.10.2 Option Parameters................................................................................... 5-23

4.11 Supervisor Parameters ................................................................................... 5-25

4.11.1 Overview .................................................................................................. 5-25

4.11.2 Supervisor Parameter Registers.............................................................. 5-25

4.12 Calibration Function ........................................................................................ 5-26

4.12.1 Overview .................................................................................................. 5-26

4.12.2 Calibration Zero Offset and Span Adjustment Registers......................... 5-27

4.13 Security Parameter ......................................................................................... 5-29

4.13.1 Overview .................................................................................................. 5-29

4.13.2 Security Parameter Register.................................................................... 5-29

4.14 Process Value and Setpoints.......................................................................... 5-30

4.14.1 Overview .................................................................................................. 5-30

4.14.1.1 Introduction ....................................................................................... 5-30

4.14.1.2 Where Setpoints Are Stored in the Controller .................................. 5-30

4.14.1.3 Purpose of Second Setpoint............................................................. 5-30

4.14.1.4 Purpose of Remote Analog Setpoint ................................................ 5-30

4.14.1.5 Purpose of Recipe Setpoint .............................................................. 5-31

4.14.1.6 Purpose of Active Setpoint ............................................................... 5-31

4.14.2 PV and SV Registers ............................................................................... 5-32

4.15 Controller Information and Status Values ....................................................... 5-33

4.15.1 Overview .................................................................................................. 5-33

4.15.1.1 Introduction ....................................................................................... 5-33

4.15.1.2 Purpose of Contact/Digital Input State ............................................. 5-33

4.15.1.3 Purpose of Resume Exhaustion Flag ............................................... 5-33

4.15.1.4 Interpreting the Status Byte and the LED Status Indicator Byte ...... 5-33

4.15.2 Controller Information and Status Parameter Registers .......................... 5-35

5. Controller Parameters Arranged by Register Address ......................... 6-1

5.1 Overview ........................................................................................................... 6-1

5.2 Integer Registers............................................................................................... 6-1

5.2.1 Introduction ................................................................................................ 6-1

5.2.2 Register List ............................................................................................... 6-1

vi Ó Omega. 900M062U00

Table of Contents

5.3 Registers for Parameters That Can Use Fractional Values.............................. 6-5

5.3.1 Introduction ................................................................................................ 6-5

5.3.2 Register List ............................................................................................... 6-5

6. Troubleshooting ...................................................................................... 7-1

6.1 Introduction ....................................................................................................... 7-1

6.2 No Reply from Controller .................................................................................. 7-1

6.3 Controller Sends an Error Code $02 Message................................................. 7-2

6.4 Controller Sends an Error Code $03 Message................................................. 7-2

6.5 Controller Reply to a Function 16 ($10) Write Message Indicates Too

Few Words Were Written................................................................................ 7-3

6.6 Controller Reply to a Function 03 ($03) Read Message Starts with

Good Data, But Garbage Follows................................................................... 7-3

6.7 Master Receives Reply from More Than One Controller, or the Reply

Is Scrambled ................................................................................................... 7-3

7. Factory Commands ................................................................................. 8-1

7.1 Introduction ....................................................................................................... 8-1

7.2 Load All Parameter Defaults ............................................................................. 8-2

7.2.1 Principles ................................................................................................... 8-2

7.2.2 Example ..................................................................................................... 8-2

7.3 Perform Zero and Span Calibration .................................................................. 8-3

7.3.1 Introduction ................................................................................................ 8-3

7.3.2 Principles ................................................................................................... 8-4

7.3.3 Example ..................................................................................................... 8-4

7.3.3.1 Zero (Low) Cal........................................................................................ 8-4

7.3.3.2 Span (High) Cal...................................................................................... 8-4

7.3.4 Confirming That the Calibration Was Performed....................................... 8-5

7.4 Clear All Latched Alarms .................................................................................. 8-6

7.4.1 Principles ................................................................................................... 8-6

7.4.2 Example ..................................................................................................... 8-6

8. Index....................................................................................................... 12-1

900M062U00 Ó Omega. vii

Using MODBUS with Series C Controllers

viii Ó Omega. 900M062U00

2.1 About This Manual

This manual describes the Omega implementation of the MODBUS protocol for the controllers: CN8200, CN8240, and CN8260. The Omega MODBUS implementation enables a MODBUS master to read every configuration parameter, setpoint, and status value stored in the controllers’ databases, as well as to write to every configuration parameter and setpoint in the controllers. MODBUS functions used to read and write these values, as well as the addresses in the MODBUS register map used to read and write values to the controllers’ databases.

Although this manual contains some general information about how the MODBUS protocol is used, the focus of this manual is the Omega implementation of the MODBUS protocol with controllers. When writing this manual we have assumed that you are familiar with the MODBUS protocol.

This manual contains tables that list every parameter, setpoint, and status value stored in the controllers and the valid values for each.

Information about the purpose of every configuration parameter, about the relationships between parameters, and about the effects of setting specific values, is in the (CN8200, CN8240, and CN8260) Controller Configuration and Operation Manual.

Diagrams that show the terminals to use when wiring the controllers to a MODBUS network are in the installation manual supplied with each Omega controller.

2. Introduction

This manual contains information about the

To be able to communicate with a MODBUS master, an Omega controller must contain an RS-485

communication option card and the Omega MODBUS communication firmware.

900M062U00 Ó Omega 2-1

Using MODBUS with Series C Controllers

2.2 About Omega’s Implementation of the MODBUS Protocol

2.2.1 MODBUS Function Codes Supported

2.2.1.1 Functions to Access the Controller Databases

The MODBUS protocol provides a means for a master (host) device to communicate with slave devices (in this case controllers) on the network. The network can contain other MODBUS-compliant devices in addition to Omega controllers.

Every message sent from a MODBUS master to a slave on the network contains a function code that represents the action the slave device should take in response to the message. So that a MODBUS master can read and write all configuration parameters, setpoints, and status values stored in an Omega controller, the Omega implementation of the MODBUS protocol supports the following function codes:

· function 03 ($03)3 – This function is used to read to one or more contiguous “holding registers” (database locations that are next to one another in the register map). See 2.2 for more information.

· function 06 ($06) – This function is used to write to a single holding register. A message containing function 06 can be broadcast to all controllers on the network simultaneously by sending the message to the controller ID of 0 (zero), instead of the controller ID of a specific device. See 2.3 for more information.

· function 16 ($010) – This function is used to write to a single register or to multiple contiguous holding registers, that is, to two or more registers that are next to one another in the register map. A message containing function 16 ($10) can be broadcast to all controllers on the network simultaneously by sending the message with the controller ID of 0 (zero), instead of the controller ID of a specific device. See 2.4 for more information.

2.2.1.2 What Happens if the Controller Can Do What the MODBUS Master Tells It to Do

If the MODBUS slave device (controller) is able to act on a message (sent to a single controller) that contains a 03 read function, or a 06 or 16 ($10) write function, then the controller will send a reply to the master.

· In the case of the 03 read function, this reply will contain the requested information.

· If a write function 06 or 16 ($10) message is sent to a specific controller, this reply will consist of a confirmation of the quantity of holding registers to which data was written in response to the message.

Peer-to-peer communications are not supported by the MODBUS protocol. This means that the controllers cannot communicate with one another, nor with other MODBUS slave devices. The MODBUS protocol does not allow slave devices to initiate data exchanges. The slave devices can only respond to messages from the MODBUS master.

Throughout this manual hexadecimal numbers are preceded by the $ symbol. (All the numbers in a MODBUS message are expressed in hexadecimal format.) Any number in this manual without the $ symbol is a decimal number.

2-2 Ó Omega 900M062U00

Introduction

If a message containing a 06 or 16 ($10) write function is broadcast to all devices on the network, then the controllers will write the data to their databases as requested, but the controllers will not send a confirmation message to the master.

2.2.1.3 What Happens if the Controller Cannot Do What the MODBUS Master Tells It to Do

Sometimes a controller cannot act on a message because communication between the master and the controller is not possible (for example, because of a fault in the network or because the controller has not been powered up). However, in some cases the controller will not act on a message sent by the master because the master sent a faulty message to the controller; the result depends on the type of fault.

· If a read or write message from the master contains the address of an invalid register, the controller will send a MODBUS error code 03 message

back to the master. See 2.2.6, 2.3.5 and 2.4.6.

· If a write message from the master instructs a controller to write invalid (out of range) data to a valid register, or to write to a read-only register, the

controller will send a MODBUS error code 02 message back to the master. See

2.3.6 and 2.4.7.

· If a 03 read message or a 16 ($10) write message from the master instructs the controller to read or write too many words, the message will be ignored

and no error message will be sent to the master. The maximum number of words supported by MODBUS functions 03 and 16 ($10) consists of 24 registers. Depending on the type of value being handled, this can equate with 24 or 12 values. See 1.2.6 and Section 3 for information about the types of values, which can be read from and written to the controllers.

· If the message contains a MODBUS function code other than 03, 06, 08 subfunction 00 (see 1.2.1.4), or 16 ($10), then the controllers will not act on the

message from the MODBUS. The controller receiving a message that contains an unsupported function code will not send an error message back to the master.

2.2.1.4 Diagnostic Function

So that you can test communication over the MODBUS network, Omega also supports the diagnostic function 08 ($08), subfunction 00 ($00) to perform a loopback test; see

2.5 for more information. When a loopback test is performed, the MODBUS master sends a message to a controller and the controller sends the same message back to the master. (No changes are made to the controller database as a result of processing the message.) If the master does not receive a reply, it is time to troubleshoot the network or the controller’s communication setup.

2.2.2 MODBUS Transmission Mode Supported

The Omega Implementation of the MODBUS protocol supports RTU (Remote Terminal Mode) only. RTU mode permits faster data throughput than does ASCII mode at the same baud rate.

900M062U00 Ó Omega. 2-3

Using MODBUS with Series C Controllers

2.2.3 Baud Rates Supported

The Omega controllers can communicate with the MODBUS master at the following baud rates:

· 300

· 600

· 1200

· 2400

· 4800

· 9600; this is the default rate for all Omega controllers equipped with Omega

MODBUS communication firmware.

The baud rate used by a controller can be changed using a MODBUS message (see

1.3). The baud rate of a CN8200, CN8240, or CN8260 controller can also be changed using the front panel to access and change the value of the

item.4

SerL (serial) menu bAud

2.2.4 Serial Data Formats Supported by the Controllers

Every Omega controller that is equipped with MODBUS communication firmware supports the following serial data formats:

· 1 start bit, 8 data bits, no parity (0 bits), 1 stop bit; this is the default

· 1 start bit, 8 data bits, even parity (1 bit), 1 stop bit

· 1 start bit, 8 data bits, odd parity (1 bit), 1 stop bit

The data format used by a controller can be changed using a MODBUS message (see

1.3.4.3). The data format for a CN8200, CN8240, CN8260 controller can also be changed using the front panel to access and change the value of the

PAr (parity) item. The menu selections are none (the default), EuEn (even), and odd.

2.2.5 Addresses Supported by the Controllers

Each controller on the MODBUS network must be assigned a unique ID number used as the device address when the master sends out a message. Valid addresses for Omega controllers using the MODBUS protocol are 1 to 247.

The address of a CN8200, CN8260, or CN8260 controller can be set using the front panel as described in the (CN8200, CN8240, and CN8260) Controller Configuration and Operation Manual. The address of a controller is set using the DIP switches as described in the installation manual supplied with the controller. (The address of 255 has a special meaning for a controller. Setting the DIP switches to 255 returns the controller’s communication parameters to their defaults.)

SerL (serial) menu

The controller does not have a display and keypad. Instructions for using the CN8200, CN8240 and CN8260 controllers’ front panel to change a configuration parameter setting are in the (, CN8200, CN8240, and CN8260) Controller Configuration and Operation Manual.

2-4 Ó Omega 900M062U00

2.2.6 Data Types Used by Controllers

2.2.6.1 Principle

Two types of values are used by Omega controllers as configuration parameter values, setpoints, statuses, etc.:

· values that can be only integers

· values that can include fractional values, that is, numbers that can include

decimal places (such as 123.6, 9.75, and –3.6)

2.2.6.2 Examples

Examples of values used by the controller that can be only integers are the configuration parameter value that represents the input type ( 0 = B thermocouple, 1 = C thermocouple, 2 = E thermocouple, etc.) and the value that represents the controller mode (1 = manual, 2 = standby, 3 = automatic, etc.).

Examples of values that can include decimal values are the setpoint, process value, and proportional band.

Introduction

2.2.6.3 How These Data Types Are Transmitted in MODBUS Registers

Because each MODBUS register contains a 16-bit value, reading or writing a parameter value for which the controller always uses an integer is straightforward. The integer can be transmitted in a single register. (Negative integers are transmitted in two’s complement format.)

Transmitting a value that can include a fractional value is a greater challenge. The Omega MODBUS implementation provides three methods of transmitting each controller value that can include decimal places.

· in a single register as an integer. Sometimes the fractional part of the number stored in the controller’s database is rounded off; sometimes the fractional part of the number is included without the decimal point. See 3.7 for information about the circumstances that determine how the fractional value is handled. (Negative integers are transmitted in two’s complement format.)

· in a single register as an integer that is 10 times the value stored in the controller’s database. This is called the “10X mirror”. Using the 10X mirror enables you to access a fractional value rounded to the nearest tenth, as described in 3.8. (Negative integers are transmitted in two’s complement format.)

· in two registers as a true 32-bit IEEE floating point value that includes the fractional value (if any) stored in the controller’s database. This is called the “32-bit IEEE mirror” (see 3.9).

The register region you choose to use to transmit a parameter value that can contain a fractional value usually depends on the type of values the MODBUS master can handle, but is also affected by the type of input the controller uses (see 3.6.2). The subject of transmitting integers and values that can include decimal places is covered in greater detail in Section 3. That section also describes the regions of the MODBUS register map used for each type of value.

900M062U00 Ó Omega. 2-5

Using MODBUS with Series C Controllers

2.2.7 IEEE Register Ordering

2.2.7.1 Principle

Each value read from and written to the 32-bit IEEE mirror region of the MODBUS register map uses two 16-bit registers to transmit the value. The default for all Omega controllers using MODBUS is to transmit the lower order register before the higher order register, which is the MODBUS standard. However, to accommodate masters that cannot use this standard sequence, the sequence in which these two register values are transmitted is configurable.

The IEEE register sequence used by a controller can be changed using a MODBUS message (see 1.3). The IEEE register sequence for a CN8200, CN8240, or CN8260 controller can also be changed using the instrument’s front panel to access and change the value of the

yes for MODBUS standard sequence (the default: low order register before high order)

no for non-standard sequence (high order register before low order).

and

2.2.7.2 Example

The 32-bit IEEE representation of 250.0 (expressed in hex) is $437A 0000. Using the MODBUS standard sequence, the registers will be transmitted in this order: $0000 437A. If the non-standard sequence is used, the registers will be transmitted in this order: $437A 0000.

SerL (serial) menu nnOd (MODBUS) item. The menu selections are

Note that the IEEE register ordering does not affect the sequence in which the bytes within the register are transmitted. Within the register, the most significant (high order) byte is always transmitted before the least significant (low order) byte.

2-6 Ó Omega 900M062U00

2.2.8 Timing and Latency Issues

2.2.8.1 Separating Messages

The MODBUS specification requires that all MODBUS messages be separated by an idle time (lull in the transmission) that has a duration that is at least 3.5 character times (that is, the time needed to transmit one character multiplied by 3.5). This necessary idle time is easily implemented at the host end by waiting at least four character times prior to sending any request. (This timing is automatically implemented on the controller side.)

2.2.8.2 Allowing the Controller Time to Process a Request

The master must wait sufficient time for a controller to process a request. This time is called “latency time”. The time needed by the controllers to process a request depends on the function code in the message and on the number of registers to be read or written. The table below shows the minimum and maximum latency time for each function.

Introduction

Function

Code

03 ($03) 5 milliseconds per register 100 milliseconds per register

06 ($06) 25 milliseconds 180 milliseconds

08 ($08) 0 milliseconds 100 milliseconds

16 ($10) 25 milliseconds per register 180 milliseconds per register

Minimum

Latency Time

2.2.8.3 Applying the Timing Requirements

The following diagram illustrates timing relationships in Omega MODBUS transactions.

T1T2T3T4 Request T1T2T3T4 T5 Response T1T2T3T4 Request

T1T2T3T4 are the 4 characters of idle time required by the MODBUS protocol. Request

and Response are the request messages sent by the host and the response message returned by the controllers.

T5 is the latency time required by each controller to process each request.

The master should expect the start of the acknowledgement after the minimum T5 has elapsed, but should time out and assume an error if the maximum T5 has elapsed and the start of the acknowledgement has not been received. Following this guideline will yield the fastest system possible.

Maximum

T1T2T3T4 is dependent on the BAUD rate and data format used. The formula for

calculating T1T2T3T4 follows.

T1T2T3T4 = 4 X ( ( X CharBits ) milliseconds

1000 baud

where:

CharBits =

10 if the data format is 8 data bits, no parity, 1 stop bit 11 if the data format is 8 data bits, even parity, 1 stop bit 11 if the data format is 8 data bits, odd parity, 1 stop bit

900M062U00 Ó Omega. 2-7

Using MODBUS with Series C Controllers

2.2.8.4 Example

Suppose the network is operating at 9600 baud and 8, N, 1, and you want to read two registers (in a single message). In this case, T1T2T3T4, the delay needed to separate messages, is:

4 x (1000/9600 x 10) = 4.17 milliseconds

If the master sends a request to read two registers, then the minimum T5, the minimum time required for the controller to respond is:

5 milliseconds x 2 = 10 milliseconds

Therefore, the host should wait at least T1T2T3T4 plus the minimum T5 before it expects the start of the response from the controllers:

4.17 milliseconds + 10 milliseconds = 14.17 milliseconds

However, if the master does not receive the start of the response by the time T1T2T3T4 plus the maximum T5 has elapsed, the master should assume an error. In this case, the maximum T5 is:

100 milliseconds x 2 = 200 milliseconds

Therefore the master should assume an error if it has not received the start of the response in:

4.17 milliseconds + 200 milliseconds = 204.17 milliseconds

2-8 Ó Omega 900M062U00

Introduction

2.3 Preparing Controllers for Use with MODBUS

2.3.1 Introduction

The controllers should be installed and networked in accordance with the instructions in the installation manual supplied with the controllers.

Warning All wiring should be done by an experienced technician and be

installed in accordance with national and local electrical codes. To avoid serious personal injury and damage to equipment, follow all warnings and cautions provided in the controller installation manuals.

In addition, to respond to messages from a MODBUS master, the controller must satisfy three requirements.

· It must contain an RS-485 communication option card and the appropriate communication firmware; see 1.3.2.

· It must be configured to have a unique controller ID between 1 and 247; see

1.3.3.

· Its communication parameter settings must match those of the MODBUS master (host); see 1.3.4.

2.3.2 MODBUS Communication Option

To see if a new controller contains an RS-485 communication option card and the MODBUS communication firmware on its processor board, compare the model number on the controller’s label with the model number information in the installation manual supplied with the controller.

2.3.3 Assigning a Unique Controller ID

With the exception of special orders, every Omega controller is shipped with its controller ID set to 1. If your MODBUS network will contain more than one controller, you must assign each device on the network a unique ID number.

· For CN8200, CN8240, and CN8260 models the controller ID is configured using

SerL (serial) menu Id.no (ID number) item. Instructions for using the front

the panel display and keypad to access and change parameter values are in the (,

CN8200, CN8240, and CN8260) Controller Configuration and Operation Manual.

If the controller is not new, you have one more task to perform with the front panel. Every new controller is configured at the factory to be ready to accept parameter values for the options its hardware supports. However, if you have used the procedure in 8.2 to load all parameter defaults, then you must use the front panel of the controller to configure the

prepares the controller to receive the appropriate option parameter values. The only exception is in the case of an CN8240 or CN8260 equipped with only the serial communication option. The CN8240 and CN8260 models are always ready to receive serial communication parameter values.

Card parameter in the Optn (option) menu. This

900M062U00 Ó Omega. 2-9

Using MODBUS with Series C Controllers

· For controllers the controller ID is configured using the same set of DIP switches that are used to set the communication parameters to the defaults. Instructions for setting the DIP switches are in the installation manual supplied with the controller.

Warning

Be sure to remove power from the controller before removing the chassis from the case to access the DIP switches. Do not power up the controller while the chassis is out of the case. Failure to observe this precaution can result in exposure to a potentially lethal shock hazard.

2.3.4 Configuring the Controller Communication Parameters to Match the MODBUS Master

2.3.4.1 Communication Defaults

Any Omega controller that contains MODBUS communication firmware is shipped with its communication defaults set to:

Baud Rate = 9600 Parity = none Controller ID = 1 MODBUS standard register sequence for 32-bit IEEE values = yes

If the configuration settings in a used controller have been changed from these defaults, you can change the communication parameter values using a MODBUS message as described below. The communication settings in a CN8200, CN8240, or CN8260 controller can also be changed using the front panel to access and change the value of the

SerL (serial) menu parameters. Instructions for accessing configuration menus and

changing parameter values are in the (CN8200, CN8240, and CN8260) Controller Configuration and Operation Manual.

The communication parameters in a controller can be returned to their defaults using DIP switches as described in the installation manual supplied with the controller.

Be aware that the CN8200, CN8240, and CN8260 controllers do not have a function that will return only the communication parameters to their defaults. Using the

(supervisor) menu Ld.dp (load defaults) item in one of these controllers will return all configuration parameters and setpoints to their defaults.

supr

2-10 Ó Omega 900M062U00

2.3.4.2 Methods of Changing the Controller Configuration Parameters

If you plan to operate your network with communication characteristics that are different from the default settings, you have two choices for changing the communication settings in the CN8200, CN8240, and CN8260 controllers:

· You can use the controller front panel and the SerL (serial) menu to change the communication settings in each controller.

· You can use serial communications to change the communication parameters settings in the controllers.

Because the communication parameters in a can be set to the defaults, but not set to other values, using the DIP switches, the second method (using serial communications) is the only way to change the communication parameter values in a unit.

Of course, if the MODBUS master can operate only with communication characteristics that are different from the controller defaults, then you must use the front panel to change the communication parameter settings for the CN8200, CN8240, and CN8260 models.

However, if the MODBUS master can operate with communication characteristics that are different from the controller defaults, then you can set the master to match these defaults temporarily, change the communication parameters in the controllers by means of MODBUS messages containing write functions, then set the master to use the communication settings you actually want to use for the network.

Introduction

It is possible to change all the controllers’ communication parameter values from the defaults, even if the master does not use the standard MODBUS register sequence for 32-bit IEEE values, because all the communication parameters are stored as integers in the controllers. Therefore, the parameter values can be written to the controllers using MODBUS integer registers. As a result, the temporary incompatibility between the host’s register sequence for 32-bit IEEE values and the sequence used by the controllers will not prevent you from making the necessary changes to the controllers’ configuration parameter values.

2.3.4.3 Example of Changing the Controllers’ Communication Parameter Values Using MODBUS Messages

Here is a scenario where the master can communicate at the defaults of 9600 baud, 1 start bit, 8 data bits, no parity (0 bits), 1 stop bit and standard register order for 32-bit IEEE values. However, other non-Omega devices on the network cannot use these settings. Therefore, you want to operate your network at 300 baud, 1 start bit, 8 data bits, even parity (1 bit), 1 stop bit, and non-standard sequencing of 32-bit IEEE values.

To change the new Omega controllers’ communication parameters from their defaults, you could use the following procedure.

1) Configure the MODBUS master for 9600, 8, N, 1. (The master’s setting for 32-bit IEEE ordering does not matter, because you use only integer registers to transmit new configuration parameter values to the controllers.)

If your MODBUS host cannot use the Omega communication defaults, contact your Omega sales representative or a member of the Omega Technical Support team for assistance in changing the communication parameter values in a controller.

900M062U00 Ó Omega. 2-11

Using MODBUS with Series C Controllers

2) To change the controllers’ IEEE register ordering, write a value of 0 (zero) to the register at relative address 4084 in each controller.

Communication with the controllers will be maintained. Your ability to write to the other communication parameters will not be affected because they are transmitted using integer registers.

3) To change the parity to even, write a value of 1 to the register at relative address 4083 in the first controller. You can broadcast the message to all the devices on the network if you take the non-Omega devices out of service temporarily. (You should not allow the non-Omega devices to receive the broadcast of the change to relative register 4083 because that register is probably used for a different purpose in the register mapping of non-Omega devices.)

4) Wait 150 milliseconds.

5) Ignore the reply from the controller because it will most likely be garbage due to the parity change. If you did not broadcast the message in step 3, repeat steps 3 and 4 for each controller to be changed.

6) Configure the MODBUS master for 9600, 8, E, 1.

7) To change the baud rate to 300, write a value of 2 to the register at relative address 4082 in the controllers.

8) Wait 1 second; it takes longer to transmit at 300 baud.

9) Ignore the reply. If you did not broadcast the message in step 7, repeat steps 7 and 8 for each controller to be changed.

10) Configure the MODBUS master for 300, 8, E, 1. You are now ready to configure the other parameters in the controllers’ databases.

See the table in 5.2 for the register addresses of all the communication parameters, as well as all valid

values for these registers.

2-12 Ó Omega 900M062U00

2.4 Importance of Sequence in Which Configuration Parameters Are Written

The Omega of controllers are versatile instruments that are capable of using many types of input values and implementing several types of control strategies. To support this versatility, the controllers are capable of storing values for many configuration parameters. Interrelationships exist between the parameters. Therefore, it is important that you specify values for the configuration parameters in the correct sequence.

Once you have your MODBUS network up and running, if you plan to use a thermocouple or RTD input and if you do not plan to use degrees Fahrenheit (the default unit of measure), the first step is always to specify the unit to be used (Celsius or Kelvin). The controller uses this unit of measure for internal operations, as well as for external communications. When you change the units of measure for temperature inputs, the controller recalculates any values that have already been specified. For example, if you want the setpoint to be 100 °C, then you must change the units from the default F to C before you write the setpoint of 100 to the controller. If you change the units after write the setpoint of 100 to the controller, the controller will convert the 100 °F setpoint to

37.8 °C. In this case, you would have to reconfigure the setpoint to 100 °C to implement the control needed by your process.

Introduction

you

After the unit of measure has been changed, if necessary, from degrees Fahrenheit to your choice of Celsius or Kelvin, the next step is always to specify the type of input that each controller will receive. That means that you must specify the type of thermocouple or RTD that will provide the input to the controller, or, in the case of a linear input, the range and units of the input (0 to 20 mA, 0 to 5 V, 1 to 5 V, etc.) The type of input specified affects how the controller processes the input signal and calculates the output needed to achieve the setpoint.

Generally, the parameters should be configured in the sequence in which they are presented in Section 4. See 4.1.2 for more information about configuration sequence.

In addition to being aware of the sequence in which parameters should be configured, you should also remember that not all parameters apply to all applications. For example, if you specify that the input type is a thermocouple or RTD, then you do not have to write a value to the low scale and high scale parameters. (You can write the values, but the controller will ignore them.) However, if you use a linear input, then you must specify scaling values, or accept the factory defaults.8

For more information about the interrelationships between parameters and about the effects of setting specific values, see the (CN8200, CN8240, and CN8260) Controller Configuration and Operation Manual.

The database values in new (“out of the box”) , CN8200, CN8240, and CN8260 controllers are always the default values shown in the tables in Section 4. Instructions for using the controller front panel to return all database values in the CN8200, CN8240, and CN8260 controllers to their default values are in the (, CN8200, CN8240, and CN8260) Controller Configuration and Operation Manual. You can also use MODBUS function 16 ($10) to write a command to special registers in the , CN8200, CN8240, and CN8260 controllers to set all the database values to their defaults (excluding the address) as described in Section 7.

900M062U00 Ó Omega. 2-13

Using MODBUS with Series C Controllers

2.5 Numbering Conventions Used in This Manual

The decimal numbers in this manual are not identified with any special symbol. The hexadecimal numbers are preceded by $. For example, the function to write to multiple registers is function 16 ($10).

All the numbers in a MODBUS message are expressed in hexadecimal format because they are transmitted as 16-bit words (each consisting of two bytes).

2-14 Ó Omega 900M062U00

3.1 Overview

Every message sent from a MODBUS master to a slave on the network contains a function code that represents the action the slave device should take in response to the message. So that a MODBUS master can read and write all configuration parameters, setpoints, and status values stored in an Omega , CN8200, CN8240, or CN8260 controller, the Omega implementation of the MODBUS protocol supports the following function codes:

· function 03 ($03)9 – This function is used to read to one or more contiguous “holding registers” (database locations that are next to one another in the register map). See 2.2 for more information.

· function 06 ($06) – This function is used to write to a single holding register. A message containing function 06 can be broadcast to all controllers on the network simultaneously by sending the message to the controller ID of 0 (zero), instead of to the controller ID of a specific device. See 2.3 for more information.

· function 16 ($010) – This function is used to write to a single register or to multiple contiguous holding registers, that is, to two or more registers that are next to one another in the register map. A message containing function 16 ($10) can be broadcast to all controllers on the network simultaneously by sending the message to the controller ID of 0 (zero), instead of to the controller ID of a specific device. See 2.4 for more information.

3. MODBUS Functions Supported

So that you can test communication over the MODBUS network, Omega also supports the diagnostic function 08 ($08), subfunction 00 ($00) to perform a loopback test; see

2.5 for more information. When a loopback test is performed, the MODBUS master sends a message to a controller and the controller sends the same message back to the master. (No changes are made to the controller database as a result of processing the command.) If the master does not receive a reply, it is time to troubleshoot the network or the controller’s communication setup.

The controllers will not take any action, nor will they reply in response to any messages they cannot interpret. This includes any messages that contain a function code other than 03, 06, 16 ($10), or 08 subfunction 00.

Throughout this section the following abbreviations are used:

900M062U00 Ó Omega. 3-1

Using MODBUS with Series C Controllers

MSB = most significant byte (high byte) LSB = least significant byte (low byte) CRC = cyclical redundancy check

3.2 Function 03 ($03): Read One or More Holding Registers

3.2.1 Introduction

This function is used to read the value of one or more contiguous holding registers (that is, registers that are next to one another). Broadcasting a function 03 message is not supported by the MODBUS protocol.

When using the 03 read function, you must specify the following data:

· the controller ID of the device containing the values to be read

· the function code $03

· the relative address of the first register to be read

· the quantity of words to be read, beginning at the specified register address

The master must append a CRC value to the message.

The register address of every value that can be read from the Omega controllers is listed in Section 4.

3.2.2 Allowable Number of Words to Be Read in a Function 03 Request

Each integer register (including the registers used to transmit a fractional value as an integer) uses one word. Therefore, the value of the Number Of Words To Read field in the request message should equal the number of registers requested for database values that are transmitted as integers. (For convenience, we refer to these as “non-IEEE” registers.)

Each 32-bit IEEE floating point register uses two words. Therefore, the value of the Number of Words to Read field should equal the number of registers needed multiplied by two. For example, to request a read of two 32-bit IEEE registers, the Number Of

Words To Read field must contain the value four.

IMPORTANT The maximum number of words allowed for function code $03 is

24. This equates to 24 non-IEEE registers and 12 of the 32-bit IEEE registers. Thus, the value in the Number Of Words To Read field cannot exceed 24 ($18).

If you are not familiar with the function of a CRC, refer to the MODBUS specification available at the

modicon.com web site.

All register relative addresses are offset from 40001. See Section 3 for more information about register address regions used by the Omega implementation of the MODBUS protocol. See Sections 4 and 5 for the relative address of specific configuration parameters and other values in the controller databases.

3-2 Ó Omega. 900M062U00

3.2.3 Function 03 Request

The format for a function 03 request is shown below.

Device

Address

Function Code

First Register

Relative

Address

MODBUS Functions Supported

Number Of

Words To Read

CRC

1 byte 1 byte containing

$03

3.2.4 Function 03 Examples

Suppose you want to read four non-IEEE registers starting at relative address 0 in the controller with controller ID 1. The master should send the message shown below.

Device

Address

$01 $03 $00 $00 $00 $04 $44 $09

To read two 32-bit IEEE registers starting at relative address of 8000 ($1F40) in the same controller, the master should send the message shown below.

Device

Address

$01 $03 $1F $40 $00 $04 $42 $09

Function Code

MSB LSB MSB LSB MSB LSB

First Register

Relative

Address

First Register

Relative

Address

Number Of

Words To Read

Number Of

Words To Read

CRC

3.2.5 Function 03 Normal Reply

If the controller is able to interpret the message and read the requested registers, the device will respond to the master with a normal reply message.

The reply will consist of the following data:

· the controller ID of the device responding

· the function code $03

· the quantity of bytes read

· the value of the first word read

· the value of the second word read, and so on until

· the value of the last word read

The controller will append a CRC value to the message.

900M062U00 Ó Omega. 3-3

Using MODBUS with Series C Controllers

The format for a function 03 normal reply is shown below.

Device

Address

1 byte 1 byte

Function

Code 03

containing

Number Of

Bytes

Read

1 byte MSB LSB …. MSB LSB MSB LSB

$03

Value Of

First Word

Read

….

Value Of

Last Word

Read

CRC

The block containing … represents the values between the first and last value. Each 2-byte word’s value must be included in the message.

3.2.6 Reply to Function 03 Request Containing Illegal Register Address: 02 ($02) Error Code

The controllers will issue an error reply containing the MODBUS error code of $02 if either of the following conditions is true:

· First Register Relative Address field does not point to a valid Omega MODBUS register, or

· First Register Relative Address field contains an odd value that is located in the 32-bit IEEE register address region. All 32-bit IEEE register addresses must be even.

A code $02 error message will be returned only if the First Register Relative Address field contains an address of an invalid register. Otherwise, reading will continue to the last register even in the event of invalid register addresses occurring after the first register. Garbage data will be returned for invalid register addresses.

The format for an error code $02 response to a function $03 message is shown below. Note that the controller adds $80 to function code $03 in the reply.

Device Address Function Code Error Code CRC

1 byte $83 $02 MSB LSB

3-4 Ó Omega. 900M062U00

MODBUS Functions Supported

3.2.7 Circumstances Under Which No Reply Is Sent in Response to a Function 03 Message

The CN8200, CN8240, CN8260 will not send a reply to a function code $03 message if any of the following conditions exist:

· The message was a broadcast.

· The value of the CRC field does not equal the CRC calculated by the controller

for the message received.

· The value in the Number of Words to Read field is greater than the maximum of 24 ($18).

· Value in Number of Words to Read field is not even when addressing 32-bit IEEE registers. Each 32-bit IEEE register consists of two bytes; therefore their byte counts must be even.

3.3 Function 06 ($06): Write to a Single Holding Register

3.3.1 Introduction

This function is used to set the value of a single holding register. The function 06 write function can be broadcast.

When using the 06 write function, you must specify the following data:

· the controller ID of the device to which the value is to be written

· the function code $06

· the relative address of the register to be written

· the value to be written to the specified register

The master must append a CRC value to the message.

This function can be used to write to any integer register (including the registers used to transmit a fractional value as an integer). Because each 32-bit IEEE value uses two registers, the 06 write function cannot be used for 32-bit IEEE values. (Instead, use the 16 ($10) write function for 32-bit IEEE floating point values.) The controller will respond with a $02 (illegal address) error message if you try to use function 06 to write to a 32-bit IEEE register.

3.3.2 Function 06 Request

The format for a function 06 request is shown below.

Device

Address

Function Code

Relative

Address

Data CRC

1 byte 1 byte

containing

$06

900M062U00 Ó Omega. 3-5

MSB LSB MSB LSB MSB LSB

Using MODBUS with Series C Controllers

3.3.3 Examples

Suppose you want to write the value 50 ($32) to the non-IEEE register at relative address 4009 ($FA9) in the instrument with controller ID 156 ($9C). The master should send the message shown below.

Device

Address

$9C $06 $0F $A9 $00 $32 $C7 $66

Suppose you want to write the value 5 ($05) to the non-IEEE register at relative address 4082 ($1E2) in all the controllers on the network (that is, broadcast the message). The master should send the message shown below.

Device

Address

$00 $06 $01 $E2 $00 $05 $E9 $D2

Function Code

Relative

Address

Relative

Address

Data CRC

3.3.4 Function 06 Normal Reply

If the controller is able to interpret the message and write the data as requested, the device will respond to the master with a normal reply message if the message was not broadcast. If the message was broadcast, then the controller will write the data to the specified registers, but will not send a reply.

The reply to a message sent to a single device will be an echo of the write message. That means that the format and content of the reply will be exactly the same as the format and content of the message sent by the master.

Device

Address

1 byte 1 byte

Function Code

containing

$06

Relative

Address

MSB LSB MSB LSB MSB LSB

Data CRC

3.3.5 Reply to Function 06 Request Containing Illegal Register Address: 02 ($02) Error Code

The controllers will issue an error reply containing the MODBUS error code of $02 if either of the following conditions is true:

· Register Relative Address field does not point to a valid Omega MODBUS register, or

· Register Relative Address field contains an address that is located in the 32-bit IEEE register address region. The 06 write function can write to only one register, and every 32-bit IEEE value requires two registers.

3-6 Ó Omega. 900M062U00

+ 96 hidden pages

Omega Products CN8200 Installation Manual

Specifications and Main Features

Frequently Asked Questions

User Manual

2.1 About This Manual

Introduction

2.3 Preparing Controllers for Use with MODBUS

2.4 Importance of Sequence in Which Configuration Parameters Are Written

2.5 Numbering Conventions Used in This Manual

3.1 Overview

3.2 Function 03 ($03): Read One or More Holding Registers

3.3 Function 06 ($06): Write to a Single Holding Register