Instruction manual Modbus TM Protocol

Transcription

1 Instruction manual Modbus TM Protocol October 2013 Part no.: Rev. 4 Honeywell Enraf P.O. Box AV Delft Netherlands Tel.: , Fax: hfs-tac-support@honeywell.com Website: Instruction manual Modbus TM Protocol Page 1

2 Copyright Enraf B.V. All rights reserved. Reproduction in any form without the prior consent of Enraf B.V. is not allowed. This instruction manual is for information only. The contents, descriptions and specifications are subject to change without notice. Enraf B.V. accepts no responsibility for any errors that may appear in this instruction manual. The warranty terms and conditions for Enraf products applicable in the country of purchase are available from your supplier. Please retain them with your proof of purchase. Page 2 Instruction manual Modbus TM Protocol

3 Preface Preface This manual has been written for the technicians involved with the communication with the Honeywell Enraf series 880 communication interface units via Modbus TM. For installation and commissioning of the CIU Prime/Plus, please refer to the related installation guide and instruction manual Ensite Pro. This manual describes the communication between a CIU Prime/Plus and higher layered systems. The communication is based on emulation of the Modbus TM protocol (Schneider Automation Modicon Modbus Protocol Reference Guide, PI-MBUS-300, Rev. B). Safety and prevention of damage "Notes" have been used throughout this manual to bring special matters to the immediate attention of the reader. A Note points out a statement deserving more emphasis than the general text. Legal aspects The information in this instruction manual is copyright property of Enraf B.V., Netherlands. Enraf B.V. disclaims any responsibility for personal injury or damage to equipment caused by: Additional information Deviation from any of the prescribed procedures; Execution of activities that are not prescribed; Please do not hesitate to contact Honeywell Enraf or its representative if you require additional information. Instruction manual Modbus TM Protocol Page 3

4 Table of contents Table of Contents Preface... 3 Introduction... 6 Communication parameters... 7 Communication procedure... 8 Memory structures Coils Input status Input registers Holding registers Function codes Function code 01: Read coil status Function code 02: Read input status Function code 03: Read holding registers Function code 04: Read input registers Function code 05: Force single coil Function code 06: Preset single register Function code 08: Diagnostics Function code 15: Force multiple coils Function code 16: Preset multiple registers Modbus exception response Function code field Data field Error code 01: illegal function Error code 02: illegal data Error code 03: illegal data value Error code 04: slave device failure Error code 06: slave device busy Page 4 Instruction manual Modbus TM Protocol

5 Table of contents Enraf implementation bit Coil area (Read/Write) Tank (Gauge) command area bit Discrete Input area (read only) CIU status Gauge status Gauge level alarm status External contact status bit area User tank data area User CIU data area Example Enraf implementation Appendix A: Related documents Instruction manual Modbus TM Protocol Page 5

6 Introduction Introduction Modbus is the name given to a set of rules (procedures) to follow when transferring data from one computer to another. Like two people communicating with each other, they both must use the same language and grammar to understand each other. Such a set of computer communication rules is commonly called a protocol. Modbus protocol defines the format of the data and the techniques used to control the flow of data. Modbus communication can take place on virtually any physical platform: RS-232, RS-485, modem-to-modem, etc. Modbus protocol also specifies that the flow of data between two devices uses a Master/ type arrangement. Multiple Modbus devices may exist on the same common cable forming a Modbus network, but only two devices will communicate at any one time, a master and a slave. There can be between 2 and 248 devices on a Modbus network, one master and up to 247 slaves. In Modbus communication you must always have one master and at least one slave. The master always initiates a communication exchange. Each slave device on a Modbus network has its own unique. This is sent by the master as part of every message. All slave devices on the network see the message, but only the slave device with the matching will respond to the message. A message sent to a slave from the master is called a query, the answer sent back to the master is called a response. Query and response messages are also called packets or frames. There are actually different versions of Modbus: Standard Modbus, Extended Modbus, Modbus Plus. There may be more, but what is used by Enraf is Standard Modbus (RTU mode), as defined in the Schneider Automation Modicon Modbus Protocol Reference Guide, (PI-MBUS-300, Rev. B). This is by far the most universal and most widely used version of the Modbus protocol. Page 6 Instruction manual Modbus TM Protocol

7 Communication parameters Communication parameters Controllers can be set up to communicate on standard Modbus networks using RTU (Remote Terminal Unit) transmission mode. It defines the bit contents of message fields transmitted serially on those networks. It determines how information will be packed into the message fields and decoded. The following communication parameters are supported: Transmission mode RTU mode (RS-232/485 only asynchronous) Baudrate 1200, 2400, 4800, 9600, 19200, Parity None, Odd, Even, Mark or Space Start bit 1 Data bits 8 Stop bit(s) TX/RX mode Turn around delay Break detection 1 (if parity = odd or even ) 2 (if parity = none ) Full duplex: RTS and DSR are set Half duplex: Full support of RTS, CTS, DTR, DSR and DCD Adjustable in msec. When selected Data flow type arrangement only Instruction manual Modbus TM Protocol Page 7

8 Communication procedure Communication procedure A Modbus message is placed by the transmitting device into a frame that has a known beginning and ending point. This allows receiving devices to begin at the start of the message, read the portion and determine which device is ed, and to know when the message is completed. Partial messages can be detected and errors can be set as a result. RTU mode is a binary mode of data representation. Messages start with a silent interval of at least 3.5 character times. This is most easily implemented as a multiple of character times at the baud rate that is being used on the network (shown as T1T2T3T4 in the figure below). The first field then transmitted is the device. Networked devices monitor the network bus continuously, including during the silent intervals. When the first byte (the byte) is received, each device decodes it to find out if it is the ed device. Following the last transmitted byte, a similar interval of at least 3.5 character times marks the end of the message. A new message can begin after this interval. The entire message frame must be transmitted as a continuous stream. If a silent interval of more than 3.5 character times occurs before completion of the frame, the receiving device flushes the incomplete message and assumes that the next byte will be the field for a new message. Similarly, if a new message begins earlier than 3.5 character times following a previous message, the receiving device will consider it a continuation of the previous message. This will set an error, as the value in the final CRC field will not be valid for the combined messages. A typical message frame is shown below: start function data CRC check end T1T2T3T4 8 bits 8 bits n * 8 bits 2 * 8 bits T1T2T3T4 All Modbus memory es in this document are given with their hexadecimal value. Page 8 Instruction manual Modbus TM Protocol

9 Communication procedure start function synchronisation 3.5 character time elapsed The field of a message frame contains eight bits. The individual slave devices are assigned es in the range of 01...F7 ( 00 is NOT allowed). A master es a slave by placing the slave in the field of the message. When the slave sends its response, it places its own in this field of the response to let the master know which slave is responding. The function code field of a message frame contains eight bits. Valid codes are in the range of 01...FF. When a message is sent from a master to a slave device the function code field tells the slave what kind of action to perform. When the slave responds to the master, it uses the function code field to indicate either a normal (error-free) response or that some kind of error occurred. For a normal response, the slave simply echoes the original function code. For an exception response, the slave returns a code that is equivalent to the original function code with its most significant bit set to a logic 1. data The data field is constructed using sets of two 8 bit bytes (16 bit registers), in the range of FFFF. The data field of messages sent from a master to slave devices contains additional information which the slave must use to take the action defined by the function code. If no error occurs, the data field of a response from a slave to a master contains the data requested. If an error occurs, the field contains an exception code that the master application can use to determine the next action to be taken. The data field can be non-existent (of zero length) in certain kinds of messages. The function code alone specifies the action. CRC check end The CRC check field contains a 16-bit value implemented as two eight-bit bytes. The error check value is the result of a CRC (Cyclical Redundancy Check) calculation performed on the message contents. The CRC field is appended to the message as the last field in the message. synchronisation 3.5 character time elapsed Instruction manual Modbus TM Protocol Page 9

10 Memory structures Memory structures Along with the slave, the Modbus function code is another piece of data that is in every query or response packet. This piece of data specifies an action to be carried out by a Modbus slave device and the memory range (coils, input registers, etc.) affected. The following table defines the supported function codes: Code Name Memory area Description Comments 01 Read coil status (0) (0)FFFF 1 bit status information Read / write 02 Read input status (1) (1)FFFF 1 bit status information Read only 03 Read holding registers (4) (4)FFFF 16 bit value information Read / write 04 Read input registers (3) (3)FFFF 16 bit value information Read only 05 Force single coil (0) (0)FFFF 1 bit status information Read / write 06 Pre-set single register (4) (4)FFFF 16 bit value information Read / write 08 Diagnostics Force multiple coils (0) (0)FFFF 1 bit status information Read / write 16 Pre-set multiple registers (4) (4)FFFF 16 bit value information Read / write The standard range runs from F; Enraf extended this range from FFFF for use within their systems. In the table above, the number between brackets indicates an internal Modbus area. These area numbers are only used for clarification by Modbus users. In general there are four types of memory images that the Modbus host can request: Coils Status inputs Input registers Holding registers Coils All coils are located in the memory range (0) (0)FFFF. The value of coils can be 1 = ON or 0 = OFF. Coils have read/write properties. The space of the coils and the discrete inputs are combined in one 1 bit area occupying the es (0) (0)7FFF. The data can be read by using Modbus function code 01. Data for tank commands can be written using the Modbus 05 and 15 commands. Page 10 Instruction manual Modbus TM Protocol

11 Memory structures Input status Input statuses are located in the memory range (1) (1)FFFF. The value of input statuses can be 1 = ON or 0 = OFF. Input statuses are considered to be discrete inputs. Input statuses are used to store tank alarm conditions. Input statuses are read-only. The space of the coils and the discrete inputs are combined in one 1 bit area occupying the es (1) (1)7FFF. The data can be read by using Modbus function code 02. Input registers Input registers are located in the memory range (3) (3)FFFF. Register values can range from FFFF since all registers are 16 bits long. Input registers are used for analog inputs or to store values collected from the field and calculated values (level, temperature, volume, etc.). Input registers are read-only. In the 16 bit registers space both the holding registers and the input registers are combined in one space occupying the standard area from F and the extended memory area from 2710 onwards. Data can be retrieved via Modbus function code 04. Holding registers Holding registers are located in the memory range (4) (4)FFFF. Register values can range from FFFF since all registers are 16 bits long. Holding registers are used for analog outputs. Holding registers have read/write properties. In the 16 bit registers space both the holding registers and the input registers are combined in one space occupying the standard area from F and the extended memory area from 2710 onwards. Data can be retrieved via the Modbus function code 03. Via Modbus commands 06 and 16 writing can be done to some registers. Specifications for storing decimal (real, floating point, etc.) numbers and negative numbers are not part of the original Modbus documentation, although most vendors today have developed schemes for storing these numbers. The Modbus specification also does not a way to store or send characters like a, - or X. For this reason, transfer of complete tank names using Modbus is not possible unless the tank name is made up of all numbers. Instruction manual Modbus TM Protocol Page 11

12 Function codes Function codes Function code 01: Read coil status Reads the ON/OFF status of discrete outputs ((0)xxxx references, coils) in the slave. Broadcast is not supported. The maximum number of coils that can be requested in one request is 7D0 (2000 DEC ). Query The query message specifies the starting coil and quantity of coils to be read: Function 01 Starting Number of points CRC check 8 bits 8 bits 16 bits 16 bits 16 bits Response The coil status in the response message is packed as one coil per bit of the data field. Status is indicated as: 1 = ON, 0 = OFF. All coils are default OFF. Function 01 Byte count (N) Data CRC check 8 bits 8 bits 8 bits (N) * 8 bits 16 bits Function code 02: Read input status Reads the ON/OFF status of discrete inputs ((1)xxxx references) in the slave. Broadcast is not supported. The maximum number of coils requested in one request is 7D0 (2000 DEC ). Query The query message specifies the starting input and quantity of inputs to be read: Function 02 Starting Number of points CRC check 8 bits 8 bits 16 bits 16 bits 16 bits Page 12 Instruction manual Modbus TM Protocol

13 Function codes Response The input status in the response message is packed as one input per bit of the data field. Status is indicated as: 1 = ON, 0 = OFF. All status inputs are default OFF. Function 02 Byte count (N) Data CRC check 8 bits 8 bits 8 bits (N) * 8 bits 16 bits Function code 03: Read holding registers Reads the binary contents of holding registers ((4)xxxx references) in the slave. Broadcast is not supported. The maximum number of registers requested in one message is 7D (125 DEC ). Query The query message specifies the starting register and quantity of registers to be read: Function 03 Starting Number of registers CRC check 8 bits 8 bits 16 bits 16 bits 16 bits Response The register data in the response message is packed as two bytes per register, with the binary contents right-justified within each byte: Function 03 Byte count (N) Data CRC check 8 bits 8 bits 8 bits (N) * 8 bits 16 bits The response is returned when the data is completely assembled. The amount of bytes N is double the amount of requested registers, because each register occupies 2 bytes. Instruction manual Modbus TM Protocol Page 13

14 Function codes Function code 04: Read input registers Reads the binary contents of input registers ((3)xxxx references) in the slave. Broadcast is not supported. The maximum number of registers requested in one message is 7D (125 DEC ). Query The query message specifies the starting register and quantity of registers to be read: Function 04 Starting Number of registers CRC check 8 bits 8 bits 16 bits 16 bits 16 bits Response The register data in the response message is packed as two bytes per register, with the binary contents right-justified within each byte: Function 04 Byte count (N) Data CRC check 8 bits 8 bits 8 bits (N) * 8 bits 16 bits The response is returned when the data is completely assembled. The amount of bytes N is double the amount of requested registers, because each register occupies 2 bytes. Function code 05: Force single coil Forces a single coil ((0)xxxx reference) to either ON or OFF. When broadcast, the function forces the same coil reference in all attached slaves. Query The query message specifies the coil reference to be forced: Function 05 Coil Force data CRC check 8 bits 8 bits 16 bits 16 bits 16 bits Page 14 Instruction manual Modbus TM Protocol

15 Function codes Response The normal response is an echo of the query, returned after the coil state has been forced: Function 05 Coil Force data CRC check 8 bits 8 bits 16 bits 16 bits 16 bits Function code 06: Preset single register Presets a value into a single holding register ((4)xxxx reference). When broadcast, the function presets the same register reference in all attached slaves. Query The query message specifies the register reference to be preset: Function 06 Register Preset data CRC check 8 bits 8 bits 16 bits 16 bits 16 bits Response The normal response is an echo of the query, returned after the register contents have been preset: Function 06 Register Preset data CRC check 8 bits 8 bits 16 bits 16 bits 16 bits Function code 08: Diagnostics This function provides a series of tests for checking the communication system between master and slave or for checking various internal error conditions within the slave. Broadcast is not supported. Query Function 08 Subfunction Data CRC check 8 bits 8 bits 16 bits 16 bits 16 bits Instruction manual Modbus TM Protocol Page 15

16 Function codes Response The normal response is an echo of the query: Function 08 Subfunction Data CRC check 8 bits 8 bits 16 bits 16 bits 16 bits Only loopback test sub-function (0) is supported. This function is sometimes used to see if the ee is awake. Function code 15: Force multiple coils Forces each coil ((0)xxxx reference) in a sequence of coils to either ON or OFF. When broadcast, the function forces the same coil references in all attached slaves. Any es that are not allowed to overwrite generate an error code. The maximum number of es that can be downloaded with one command is 3C (60 DEC ). Byte Count means the number of bytes following until the checksum (Number of registers * 2). Query The query message specifies the coil references to be forced: Function 15 (0F HEX ) Coil Number of coils Byte count Force data CRC check 8 bits 8 bits 16 bits 16 bits 8 bits 16 bits 16 bits Response The normal response returns the slave, function code, starting, and quantity of coils forced: Function 15 (0F HEX ) Coil Number of coils CRC check 8 bits 8 bits 16 bits 16 bits 16 bits Page 16 Instruction manual Modbus TM Protocol

17 Function codes Function code 16: Preset multiple registers Presets values into a sequence of holding registers ((4)xxxx reference). When broadcast, the function presets the same register references in all attached slaves. Any es that are not allowed to overwrite generate an error code. The maximum number of es that can be downloaded with one command is 3C (60 DEC ). Byte Count means the number of bytes following until the checksum (Number of registers * 2). Query The query message specifies the register reference to be preset: Function 16 (10 HEX ) Starting Number of registers Byte count Data CRC check 8 bits 8 bits 16 bits 16 bits 8 bits 16 bits 16 bits Response The normal response returns the slave, function code, starting, and quantity of registers preset: Function 16 (10 HEX ) Starting Number of registers CRC check 8 bits 8 bits 16 bits 16 bits 16 bits Instruction manual Modbus TM Protocol Page 17

18 Modbus exception response Modbus exception response Except for broadcast messages, when a master device sends a query to a slave device it expects a normal response. One of four possible events can occur from the master's query: If the slave device receives the query without a communication error, and can handle the query normally, it returns a normal response; If the slave device does not receive the query due to a communication error, no response is returned. The master program will eventually process a time-out condition for the query; If the slave device receives the query, but detects a communication error (parity or CRC), no response is returned. The master program will eventually process a time-out condition for the query; If the slave device receives the query without a communication error, but cannot handle it (for example, if the request is to read a non-existent coil or register), the slave will return an exception response informing the master of the nature of the error. The standard error response is as follows: Function code Error code CRC check 8 bits 8 bits 8 bits 16 bits The exception response message has two fields that differentiate it from a normal response: function code field data field Page 18 Instruction manual Modbus TM Protocol

19 Modbus exception response Function code field In a normal response, the slave echoes the function code of the original query in the function code field of the response. The master's application program can recognise the exception response and can examine the data field for the exception code. The Function code returned in an error is the function code of the received function with the high order bit of the function set to 1. Data field In a normal response, the slave may return any information that was requested in the query. In an exception response, the slave returns an exception code in the data field. This code defines the slave's condition that caused the exception. Error code 01: illegal function The function code received in the query is not an allowable action for the slave. This error code is generated in the following case: when an illegal function code is requested Error code 02: illegal data The data received in the query is not an allowable for the slave. This error code is generated in one of the following cases: as reply on function code 01, 02 or 04: start register does not correspond to any tank; as reply on function code 05: coil must correspond to a tank; a change in the field scan for a system without Hot-Standby. Instruction manual Modbus TM Protocol Page 19

20 Modbus exception response Error code 03: illegal data value A value contained in the query data field is not an allowable value for the slave. This error code is generated in one of the following cases (as reply on function codes 06 and 16): illegal tank commands (e.g. 'X'); illegal downloads (e.g. TCF-value for product code A); unknown tank requested. Error code 04: slave device failure An unrecoverable error occurred while the slave was attempting to perform the requested action. This error code is generated in one of the following cases (as reply on function codes 06 and 16): block, test commands if no servo gauge; dipping commands if not allowed; illegal downloads because e.g. level is available from hardware; engineer command if destination station or port does not make sense. Error code 06: slave device busy The slave is processing a long-duration program command. The master should re-transmit the message later when the slave is free. This error code is generated in one of the following cases: when the system is busy; when the system is not able to generate an answer; when the system is not able to reply with the correct data in the required time-out period; when a request for a scan change in a Hot-Standby station is still performed, and a new request is received. Page 20 Instruction manual Modbus TM Protocol

21 Enraf implementation Enraf implementation All Modbus memory es in this chapter are in hexadecimal format. 1 bit Coil area (Read/Write) All references in the Modbus messages are numbered relative to zero. E.g. the first holding register on a DCS would be register and would be referenced as Similarly coil would be 000F (0015 DEC ) The es are fixed per port The data can be read by using the Modbus function code 01 Data for CIU- or gauge-commands can be written by using the Modbus function code 05 and 15 A graphical overview of the 1 bit coil area is as follows: 1 bit Area name Detailed name Description 000A- 1 bit Tank (gauge) In this area a command to a Tank command (gauge) can be given coil area area Grey areas are read-only Gauge commands via Coil commands are available in CIU Prime and CIU Plus. Firmware version must be or higher. Instruction manual Modbus TM Protocol Page 21

22 Enraf implementation Tank (Gauge) command area Tank gauge commands can be given by setting coils (Modbus function 05). Commands are only accepted when the required command is enabled for the ed instrument. First coil for Tank gauge commands is 000A (10 DEC ). The sequence how the tanks are ordered in the Modbus memory map defines the sequence where the tank gauge command must be given. In the table below a Relative is given from which the actual coil can be calculated by using formula: Actual Coil = 10 + [(n - 1) * 7] + relative. in which n = tank_sequence_nr in Modbus memory map. The setting of a coil is interpreted as a push button. Reading the status of a coil will always result in 0 Relative Address Read/ Write Function Description 0 R/W Unlock Writing 1 will abort all active operational commands. 1 R/W Test Writing 1 will result in repeatability test command. 2 R/W Locktest Writing 1 will result in Lock command 3 R/W Block Writing 1 will result in Block command 4 R/W Density dip Writing 1 will result in Density dip command 5 R/W Water dip Writing 1 will result in Water dip command 6 R/W Combined dip Writing 1 will result in Combined (water/density) dip command 1 bit Discrete Input area (read only) The es are fixed per port The data can be read by using the Modbus function code 02 Page 22 Instruction manual Modbus TM Protocol

23 Enraf implementation 1 bit Area name Detailed name Description CIU status area In this area the status of the CIU is represented 000A : depending number of tanks in modbus memory map 1bit discrete input area Gauge status area Gauge level alarms area External alarms area In this area the status of the tank is represented In this area the status of the gauge level alarms is represented In this area the status of the external alarms is represented Grey areas are read-only Statuses via discrete inputs are available in CIU Prime and CIU Plus. Firmware version must be or higher. CIU status The CIU status can be read. Address Read/ Write Function Description 0000 R CIUHotStandbyMode 1 indicates CIU is passive member of Hot Stand-by pair R future reserved for future Gauge status The Gauge status can be read. The total number of tanks and the sequence how the tanks are ordered in the Modbus memory map defines the sequence where the status can be read. In the tables below a relative is given from which the actual coil can be calculated by using a formula. The discrete input is calculated with formula: = 10 + [(n - 1) * 2] + relative. in which n = tank_sequence_nr in modbus memory map. Instruction manual Modbus TM Protocol Page 23

24 Enraf implementation Relative Address Read/ Write Function Description 0 R Measuring level 1 indicates level gauge is measuring level 1 R Failure 1 indicates level gauge is in failure Gauge level alarm status The Gauge level alarm status can be read. The total number of tanks and the sequence how the tanks are ordered in the Modbus memory map defines the sequence where the status can be read. In the tables below a relative is given from which the actual coil can be calculated by using a formula. The discrete input is calculated with formula: = 10 + (N * 2) + [(n - 1) * 3] + relative. in which N = total number of tanks in memory map. n = tank_sequence_nr in modbus memory map. Relative Address Read/ Write Function Description 0 R Low alarm 1 indicates low level alarm is active 1 R High alarm 1 indicates high level alarm is active 2 R Alarm failure 1 indicates alarm status failure External contact status The External contact status can be read. The total number of tanks and the sequence how the tanks are ordered in the Modbus memory map defines the sequence where the status can be read. In the tables below a relative is given from which the actual coil can be calculated by using a formula. The discrete input is calculated with formula: = 10 + (N * 5) + [(n - 1) * 4] + relative. in which N = total number of tanks in memory map. n = tank_sequence_nr in modbus memory map. Page 24 Instruction manual Modbus TM Protocol

25 Enraf implementation Relative Address Read/ Write Function Description 0 R External contact 1 1 indicates ext. contact 1 of gauge is active 1 R External contact 2 1 indicates ext. contact 2 of gauge is active 2 R External contact fail 1 indicates ext. contacts status failure 3 R External contact not available 1 indicates ext. contacts not available in gauge. 16 bit area In the 16 bit registers space both the holding registers and the input registers are combined in one space. The occupation is on a per port basis, each port can be configured inside the restrictions The data can be retrieved by using the Modbus commands 03 (holding registers) and 04 (input register) Data can be written to holding registers by using the Modbus commands 06 and 16. The same as where the data is read must be used. A graphical overview of the 16 bit register area is as follows: Register Area name Detailed name Description F3F 251C user data area User tank data area User CIU data area In this area the user can request for tank data. General data of CIU Prime/Plus Grey areas are read-only Direct overwrite of data on the Modbus register is available on the CIU Plus only. Firmware version of CIU Plus must be or higher. Instruction manual Modbus TM Protocol Page 25

26 Enraf implementation User tank data area A selection can be made which data must be presented in the user defined tankdata area. This because of the lot of information which can be retrieved. See the related Instruction manual CIU Prime or CIU Plus for a list of selectable data. One tank data reply packet is selected which is used for all tanks available to the Modbus host. The sequence how the tanks are organized in the user defined Modbus map is programmable. There are two methods possible to organize the user defined Modbus memory map: 1. Tank oriented. Data in the Modbus memory map is grouped per tank. Start of memory map is programmable. Default start is The start-interval between the tankrecords is programmable. 2. Data oriented. Data in the Modbus memory map is grouped per selected entity. Start of memory map is programmable. Default start is User CIU data area A number of CIU data registers are available to the user. Register Address Read/ Write Entity Function CIU Prime/Plus Description 2520 R/W 521 Years (yyyy) Prime/Plus CIU year (max 16383) 2521 R/W 522 Months (mm) Prime/Plus CIU month (max 12) 2522 R/W 523 Days (dd) Prime/Plus CIU day (max 31) 2523 R/W 524 Hours (hh) Prime/Plus CIU hour (max 23) 2524 R/W 525 Minutes (mm) Prime/Plus CIU minute (max 59) 2525 R/W 526 Seconds (ss) Prime/Plus CIU second (max 59) 2526 R/W 527 DayLightSaving Prime/Plus CIU DayLightSaving (0 = off; 1 = on) The above 7 registers (2520 (9504 DEC ) up to 2526 (9510 DEC )) must be written in one message using Modbus function code 16. Page 26 Instruction manual Modbus TM Protocol

27 Example Enraf implementation Example Enraf implementation Database with total 3 tanks in Modbus memory area of Host Port CIU Plus for which Product level, Product level status, Product temperature, Product temperature status must be retrieved. Observed density including the related Observed temperature will be downloaded from the host. Tank oriented Modbus map. Start of memory map 16 bit area: Tank record interval: 10 Modbus memory map 16 bit area: Adress Data description Tank Scaling Offset Type Product level (mm) bit Unsigned Integer Product level status 1 Not a number Product Temperature ( C) bit Unsigned Integer Product Temperature status 1 Not a number Density Observed (kg/m3) bit Unsigned Integer Temperature Observed ( C) bit Unsigned Integer 0006 empty 0007 empty 0008 empty 0009 empty 000A 40 Product level (mm) bit Unsigned Integer 000B 41 Product level status 2 Not a number 000C 44 Product Temperature ( C) bit Unsigned Integer 000D 45 Product Temperature status 2 Not a number 000E 50 Density Observed (kg/m3) bit Unsigned Integer 000F 118 Temperature Observed bit Unsigned Integer 0010 empty 0011 empty 0012 empty 0013 empty Product level (mm) bit Unsigned Integer Product level status 3 Not a number Product Temperature ( C) bit Unsigned Integer Product Temperature status 3 Not a number Density Observed (kg/m3) bit Unsigned Integer Temperature Observed ( C) bit Unsigned Integer 001A 001B empty empty Instruction manual Modbus TM Protocol Page 27

28 Example Enraf implementation Adress Data description Tank Scaling Offset Type 001C empty 001D empty Overwrite Observed density and Observed temperature (direct overwrite on CIU Plus only). To overwrite the Observed density (800 kg/m3) including related observed temperature (15 C) for tank 2, registers 000E and 000F must be overwritten by using function code 06 or function code 16. The data will be used for internal calculations provided that it is not automatically measured. Via function code 16: E F E +CRC in which 29 RTU (41 DEC ) 10 Function code (16 DEC) 00 0E Start (15 DEC ) Number of registers (2 DEC ) 04 Byte Count (4 DEC) 1F 40 Observed density [8000 DEC = (800 * 10) + 0] 04 7E Observed temperature [1150 DEC = (15 * 10) ] CRC Download new Date and Time: To download date and time: 14h 03m 23s, 24 September DayLightSaving. Via function code 16 (multiple registers) the download can be done: E 07 CF E CRC in which 29 RTU (41 DEC ) 10 Function code (16 DEC) Start (9504 DEC ) Number of registers (7 DEC ) 0E Byte Count (14 DEC) 07 CF Year (1999 DEC) Month (9 DEC) Day (24 DEC) 00 0E Hour (14 DEC) Minutes (3 DEC) Seconds (23 DEC) DayLightSaving on (1 DEC) CRC Page 28 Instruction manual Modbus TM Protocol

29 Example Enraf implementation After downloading the Date&Time the received data will be used to set the internal CIU clock as required. The operation can be verified by reading the same registers and interpret the contents. Coil es for Tank (Gauge) commands. Description Tankname 000A Unlock command 1 000B Test command 1 000C Lock-test command 1 000D Block command 1 000E Density dip command 1 000F Water dip command Combined dip command Unlock command Test command Lock-test command Block command Density dip command Water dip command Combined dip command Unlock command Test command 3 001A Lock-test command 3 001B Block command 3 001C Density dip command 3 001D Water dip command 3 001E Combined dip command 3 Discrete inputs (status) CIU status Description 0000 CIU Hot Standby Mode Instruction manual Modbus TM Protocol Page 29

30 Appendix A Gauge status Description Tankname 000A Gauge measuring level status 1 000B Gauge failure status 1 000C Gauge measuring level status 2 000D Gauge failure status 2 000E Gauge measuring level status 3 000F Gauge failure status 3 Gauge level alarm status Description Tankname 0010 Low alarm High alarm Alarm failure Low alarm High alarm Alarm failure Low alarm High alarm Alarm failure 3 External contact status Description Tankname 0019 External contact A External contact B External contact fail 1 001C External contact not available 1 001D External contact E External contact F External contact fail External contact not available External contact External contact External contact fail External contact not available 3 Page 30 Instruction manual Modbus TM Protocol

31 Appendix A Appendix A: Related documents Title Part no. Schneider Automation Modicon Modbus Protocol Reference Guide, PI-MBUS-300, Rev. B Installation guide 880 CIU Prime/Plus Instruction manual 880 CIU Prime Instruction manual 880 CIU Plus Instruction manual Ensite Pro Configuration Tool Instruction manual Modbus TM Protocol Page 31

32 Honeywell Enraf Delftechpark XJ Delft Tel. : hfs-tac-support@honeywell.com Website : P.O. Box AV Delft Netherlands We at Honeywell Enraf are committed to excellence. Your Honeywell Enraf distributor: Information in this publication is subject to change without notice. Enraf is a registered trade mark. Enraf B.V. Netherlands Page 32 Instruction manual Modbus TM Protocol