7866 Gas Analyzer/Indicator Modbus® RTU Serial Communications User Manual

7866 Gas Analyzer/Indicator Modbus RTU Serial Communications User Manual
51-52-25-104 9/01
Sensing and Control
Copyright, Notices, and Trademarks

Printed in U.S.A. Copyright 2001 by Honeywell Revision 0 9/01
Warranty/Remedy
Honeywell warrants goods of its manufacture as being free of defective materials and faulty workmanship. Contact your local sales office for warranty information. If warranted goods are returned to Honeywell during the period of coverage, Honeywell will repair or replace without charge those items it finds defective. The foregoing is Buyers sole remedy and is in lieu of all other warranties, expressed or implied, including those of merchantability and fitness for a particular purpose. Specifications may change without notice. The information we supply is believed to be accurate and reliable as of this printing. However, we assume no responsibility for its use. While we provide application assistance personally, through our literature and the Honeywell web site, it is up to the customer to determine the suitability of the product in the application.
Sensing and Control Honeywell 11 West Spring Street Freeport, IL 61032

Modbus is a registered trademark of MODICON, Inc. Windows is an addressed trademark of Microsoft Inc. The omission of a name from this list is not to be interpreted that the name is not a trademark.
Reference: Modicon Modbus Protocol Reference Guide - PI-MBUS-300 Rev. G
ii
7866 Analyzer/Indicator Modbus RTU Serial Communications User Manual
9/01
About This Document

Abstract
This document provides information specific to Honeywells 7866 Gas Analyzer/Indicator implementing the Modbus RTU Serial Communications protocol. It includes a summary of all 7866 data available (primarily floating point) for Modbus RTU access, read and write including methods for access.
Contacts
World Wide Web The following lists Honeywells World Wide Web sites that will be of interest to our sensing and control customers.
Honeywell Organization Corporate Sensing and Control International WWW Address (URL) http://www.honeywell.com http://www.honeywell.com/sensing http://www.honeywell.com/Business/global.asp
Telephone Contact us by telephone at the numbers listed below.

Organization United States and Canada Honeywell Phone Number 1-800-423-9883 1-888-423-9883 1-800-525-7439 (852) 2829-8298 [32-2] 728-2111 (954) 845-2600 Tech. Support Faxed documents Service
Asia Pacific Europe Latin America
Honeywell Asia Pacific Hong Kong Honeywell PACE, Brussels, Belgium Honeywell, Sunrise, Florida U.S.A.
9/01
iii
Contents
1.
1.1
INTRODUCTION ................................................................................................... 1
Modbus RTU Implementation........................................................................................................1
2.
2.1
WIRING ................................................................................................................. 3
Communications Wiring.................................................................................................................3
3.
3.1 3.2 3.3
MODBUS RTU MESSAGE FORMAT.................................................................... 5

Modbus RTU Link Layer ...............................................................................................................5 Modbus RTU Data Layer ...............................................................................................................6 IEEE 32-bit Floating Point Register Information ...........................................................................7
4.
4.1 4.2 4.3 4.4
MODBUS RTU FUNCTION CODES ................................................................... 12

Function Code 01 Read Digital Output Status ..........................................................................13 Function Codes 03/04 - Read Data Registers ...............................................................................14 Function Codes 16 (10h) - Preset Multiple Registers ..................................................................15 Function Code 17 (11h) - Report 7866 Analyzer/Indicator ID ....................................................16
5. 6.
6.1 6.2
MODBUS RTU EXCEPTION CODES ................................................................. 17 REGISTER MAP FOR PROCESS AND OPERATION TYPE VARIABLES ....... 19
Register Map Overview................................................................................................................19 7866 Analyzer/Indicator Register Map ........................................................................................19
7.
7.1 7.2 7.3
ANALYZER/INDICATOR CONFIGURATION MESSAGES (FUNCTION CODES 14H(20) AND 15H(21) ...................................................... 21

General Information......................................................................................................................21 Function Code 20 (14h) - Read Configuration Reference Data ...................................................25 Function Code 21 (15h) - Write Configuration Reference Data ..................................................29
8.
APPENDIX: CRC-16 CALCULATION ................................................................. 32
iv
9/01
Tables
Table 3-1 Modbus RTU Message Formats ________________________________________________ 5 Table 3-2 IEEE Floating Point Number Examples in FP B Format ____________________________ 11 Table 4-1 Modbus RTU Function Codes Definitions _______________________________________ 12 Table 5-1 Modbus RTU Data Layer Status Exception Codes _________________________________ 18 Table 6-1 7866 Register Map Addresses _________________________________________________ 19 Table 7-1 Register Address Structure - Integer Parameter Type _______________________________ 21 Table 7-2 Register Address Structure - Floating Point Parameter Type__________________________ 22 Table 7-3 Analog Parameter Register Addresses __________________________________________ 22 Table 7-4 Digital Parameter Register Addresses ___________________________________________ 23 Table 7-5 Range and Type ___________________________________________________________ 24 Table 7-6 Register Address Format for Function Code 20 ___________________________________ 26 Table 7-7 Register Address Format for Function Code 21 ___________________________________ 30
Figures
Figure 2-1 7866 Analyzer/Indicator Communications wiring __________________________________ 3 Figure 3-1 IEEE Floating Point Data format _______________________________________________ 7 Figure 3-2 IEEE Floating Point Formats _________________________________________________ 11
9/01
Introduction
1. Introduction
1.1 Modbus RTU Implementation
Overview This implementation is designed to provide a popular data exchange format connecting the 7866 Analyzer/Indicator Slave Port (COM A) to both Honeywell and foreign master devices. The Modbus RTU allows the instrument to be a citizen on a data link shared with other devices which subscribe to the Modbus RTU RS-485 specification. The Analyzer/Indicator DOES NOT emulate any MODICON type device. The Modbus RTU specification is respected in the physical and data link layers. The message structure of the Modbus RTU function codes are employed and standard IEEE 32-bit floating point and integer formats are used. Data register mapping is unique to these instruments. The definition in Table 6-1is the register mapping for the 7866 Analyzer/Indicator and the corresponding parameter value. Function Codes 20 and 21 Also included in this manual is information concerning function codes 20 and 21 in Section 7. They provide additional functionality not available using the function codes described in Section 4. The additional functionality includes: Read/Write dynamic data that is not part of the function code 04 register set Read/Write device data that are not part of the function code 03 register set
For Function Codes 14h(20) and 15h(21), the Byte Swap configuration does not apply. All numbers are represented in the FP B byte order. Refer to Subsection 3.3.
9/01
Introduction
9/01
Wiring
2. Wiring
2.1 Communications Wiring
When connecting the 7866 to an RS 485 communication link (see Figure 2-1), you must use termination resistors at each end of the link. The following cables with the listed resistor values can be used for connecting the 7866. RS 485 Cables: Belden #9271 (or equivalent) with 120 ohm termination resistors (2,000 ft. maximum) Belden #9182 (or equivalent) with 150 ohm termination resistors (4,000 ft. maximum) NOTE: When using the RS 485 communications, it is recommended that an RS 485 to RS 232 converter (such as Black Box model IC901A) be used to interface with the host PC. Also, be certain that the Half Duplex Turnaround Delay parameter for the converter set to 1 millisecond or less.
L1 L2/N 12 22 23 24 25 26 27 13 14 15 16 17
MODBUS OR RS422/485 HALF DUPLEX

SHD TX+/RX+ TX/RX
1
Master SHD TX+/RX+ TX/RX

120 Ohm Resistor
CAUTION Do not mix half and full duplex wiring.
To Other Communication Instruments (maximum 15)
Do not run these lines in the same conduit as AC power
120 Ohm Resistor on Last Leg
L1 L2/N 12 22 23 24 25 26 27
Use shielded twisted pair cables (Belden 9271 Twinax or equivalent)
MODBUS OR RS422/485 FULL DUPLEX

13 14 15 16 17 SHD RX+ RX TX+ TX
1
Master SHD TX+ TX RX+ RX

120 Ohm Resistor 120 Ohm Resistor
To Other lines in the same conduit as AC power Communication Instruments (maximum 15) 120 Ohm Resistor
on Last Leg
Do not run these
24169
Figure 2-1 7866 Analyzer/Indicator Communications wiring
9/01
Wiring
9/01
Modbus RTU Message Format
3. Modbus RTU Message Format

Table 3-1 Modbus RTU Message Formats Coding system Number of data bits per character 8 bit binary 10 Bits start bits - 1 data bits - 8 parity bits - 0 stop bits - 1 Parity Bit transfer rate Duplex Error checking Polynomial Bit transfer order End of message Not used 300, 600, 1200, 2400, 4800, 9600, or 19200 Selectable Full or Half duplex - Four or Two wire CRC (cyclic redundancy check) (CRC-16 10100000000001) LSB first Idle line for 3 or more characters (>1.56 msec for 19200).
3.1 Modbus RTU Link Layer

The link layer includes the following properties/behaviors:
n n n n n n n
Slave address recognition, Start / End of Frame detection, CRC-16 generation / checking, Transmit / receive message time-out, Buffer overflow detection, Framing error detection, Idle line detection.
Errors detected by the physical layer in messages received by the Analyzer/Indicator are ignored and the physical layer automatically restarts by initiating a new receive on the next idle line detection.
9/01
General Modbus RTU message format Query message format [Slave Address, Function Code, Function code dependent data, CRC 16] Response message format [Slave Address, Function Code*, Function code dependent data, CRC 16]
* If an error is detected in a valid message the response function code is modified by adding 80 (hex) and the function code dependent data is replaced by an exception response code as described in Section 5 - Modbus RTU Exception Codes.
Between messages, the RS-485 link is in a high impedance state. During this time receiving devices are more susceptible to noise generated false start of messages. Although noise-generated messages are rejected due to address, framing, and CRC checking, they can cause the loss of a good message when they are included in the message stream. In the slave the transmitting device enables its transmitter line diver and forces an idle line state onto the link for three character time slots prior to transmitting. This forces termination of any noise generated messages and improves message frame synchronization.
3.2 Modbus RTU Data Layer

The data layer includes: Diagnostic loopback, Function code recognition / rejection, Busy / repoll, Data error code generation
Errors detected by the data layer are rejected and the slave responds to the polling device with a Modbustype status exception error. A summary of the Modbus status exception codes is listed in Section 5 Modbus RTU Exception Codes.
9/01
3.3 IEEE 32-bit Floating Point Register Information

The Modbus applications support IEEE 32-bit floating point information for several of the function codes.
3.3.1 IEEE Floating Point Data Format

The formula for calculating the floating point number is:
(exponent -127)
mantissa x 2
(23 bit signed binary with 8 bit biased binary exponent) byte 4 byte 3 3 2 2 1 1 4 3 6 xxxxxxxx x.xxxxxxx byte 2 1 5 8 xxxxxxxx byte 1 7 0 xxxxxxx
mantissa (23 bits) implied binary point for mantissa exponent (8 bit unsigned value) sign of the mantissa 0 = positive, 1 = negative
Figure 3-1 IEEE Floating Point Data format Mantissa and Sign The mantissa is defined by a sign bit (31) and a 23-bit binary fraction. This binary fraction is combined with an implied value of 1 to create a mantissa value, which is greater than or equal to 1.0 and less than 2.0. The mantissa is positive if the sign bit is zero (reset), and negative if the sign bit is one (set). For example:
DECIMAL 100 HEXADECIMAL 42C80000 BINARY 01000010 11001000 00000000 00000000
The sign bit (31) is zero, indicating a positive mantissa. Removing the sign bits and exponent bits, the mantissa becomes:
HEXADECIMAL 480000 BINARY xxxxxxxx x1001000 00000000 00000000
Add an implied value of one to the left of the binary point:

BINARY 1.1001000 00000000 00000000
Using positioned notation, this binary number is equal to:
10 + (1x2 -1 ) + (0x2 -2 ) + (0x2 -3 ) + (1x2 -4 ) = 10 + 0.5 + 0.0 + 0.0 + 0.0625 = 15625 . . .
9/01
Exponent The exponent is defined by an unsigned 8-bit binary value (bits 23 through 30). The value of the exponent is derived by performing a signed subtraction of 127 (decimal) from the 8-bit exponent value.
DECIMAL 100 HEXADECIMAL 42C80000 BINARY 01000010 11001000 00000000 00000000
Removing the sign and mantissa bits, the exponent becomes:

DECIMAL 133 HEXADECIMAL 85 BINARY x1000010 1xxxxxxx xxxxxxxx xxxxxxxx
or:
1x2 7 + 0x2 6 + 0x2 5 + 0x2 4 + 0x2 3 + 1x2 2 + 0x2 1 + 1x2 0

Subtract a bias of 127 (decimal) from the exponent to determine its value: 133 127 = 6.
Mantissa and Exponent Combination Combining the mantissa and exponent from the two previous examples:
float number = mantissa x 2 exponent float number = 1.5625 x 2 6 = 15625 x 64 = 100.0 .

Below is a list of sample float values in IEEE format:
DECIMAL 100.0 -100.0 0.5 -1.75 0.0625 1 0
HEXADECIMAL 42C80000 C2C80000 3F000000 BFE00000 3D800000 3F800000 00000000
9/01
Reserved Operands Per the Standard certain exceptional forms of floating point operands are excluded from the numbering system. These are as follows:
EXCEPTION +/- Infinity Not-a-Number (NAN) Denormalized Number Zero
EXPONENT All 1s All 1s All 0s All 0s
MANTISSA All 0s Other than 0s Other than 0s All 0s
3.3.2 Modbus Double Register Format

Each IEEE 32-bit floating point number requires two consecutive registers (four bytes) starting with the register defined as the starting register for the information. The stuffing order of the bytes into the two registers differs among Modbus hosts. To provide compatibility, the 7866 ANALYZER/INDICATOR Double register format is configurable. To set the 7866s double register byte order, go to the prompt WS_FLOAT under "Set UP Modbus Communications Group"and configure Modbus Double Register Format. The selections are: Selection FP B Description Floating Point Big Endian Format Byte order (See Figure 3-1) 0, 1, 2, 3 Notes 7866 Analyzer/Indicator default
FP BB FP L FP LB
Floating Point Big Endian with byte-swapped Floating Point Little Endian Format Floating Point Little Endian with byte-swapped
1, 0, 3, 2 3, 2, 1, 0 2, 3, 0, 1
See IEEE Formats starting on next page. NOTE: Byte Swapping only applies to Function Codes 3, 4, and 16. Function Codes 20 and 21 DO NOT support byte swapping. They always use FP B.
9/01
IEEE Floating Point Formats
FP B - Floating Point Big Endian Format:

Bit 0 Bit 31
E0 M22 M21M20 M19 M18 M17 M16 S E7 E6 E5 E4 E3 E2 E1 M7 M6 M5 M4 M3 M2 M1 M0
M15 M14 M13 M12 M11 M10 M9 M8
High
REGISTER N (High)
Low
High
REGISTER N+1 (Low)
Low
S=Sign E=Exponent M=Mantissa
FP BB - Floating Point Big Endian with Byte Swapped Format:

Bit 31 Bit 24 Bit 15 Bit 8
S E7 E6 E5 E4 E3 E2 E1
M15 M14 M13 M12 M11 M10 M9 M8
Bit 23
Bit 16
Bit 7
Bit 0
E0 M22 M21M20 M19 M18 M17 M16
M7 M6 M5 M4 M3 M2 M1 M0
High
REGISTER N (High)
Low
High
REGISTER N+1 (Low)
Low
continued next page
10
9/01
FP L - Floating Point Little Endian Format:

M15 M14 M13 M12 M11 M10 M9 M8
S E7 E6 E5 E4 E3 E2 E1
Bit 7
Bit 0
Bit 23
Bit 16
M7 M6 M5 M4 M3 M2 M1 M0
E0 M22 M21M20 M19 M18 M17 M16
High
REGISTER N (High)
Low
High
REGISTER N+1 (Low)
Low
FP LB - Floating Point Little Endian with Byte Swapped Format:

M7 M6 M5 M4 M3 M2 M1 M0
E0 M22 M21M20 M19 M18 M17 M16
Bit 15
Bit 8
Bit 31
Bit 24
M15 M14 M13 M12 M11 M10 M9 M8
S E7 E6 E5 E4 E3 E2 E1
High
REGISTER N (High)
Low
High
REGISTER N+1 (Low)
Low
Figure 3-2 IEEE Floating Point Formats
Table 3-2 IEEE Floating Point Number Examples in FP B Format Value (decimal) 100.0 55.32 2.0 1.0 -1.0 IEEE FP B MSB LSB 42C80000h 425D47AEh 40000000h 3F800000h BF800000h Register N high 42h 42h 40h 3Fh BFh low C8h 5Dh 00h 80h 80h Register N+1 high 00h 47h 00h 00h 00h low 00h AEh 00h 00h 00h
9/01
11
Modbus RTU Function Codes
4. Modbus RTU Function Codes

The Honeywell Universal Modbus RTU protocol uses a subset of the standard Modbus RTU function codes to provide access to process-related information. These standard function codes provide basic support for IEEE 32-bit floating point numbers and 16-bit integer register representation of instruments process data. Table 4-1 lists the Modbus RTU Function Code definitions. Repolling of data is not supported by this analyzer. Table 4-1 Modbus RTU Function Codes Definitions Function Code 01 03 04 16 (10h) 17 (11h) 20 (14h) 21 (15h) Name Read Discrete Outputs Read Holding Registers Read Input Registers Preset Multiple Registers Report Slave ID Read General Reference Write General Reference Usage Read bit mapped data - digital outputs floating point formatted data 16 bit Integer Formatted data Write floating point formatted data. Read instrument specific data Read configuration data Write configuration data
12
9/01
4.1 Function Code 01 Read Digital Output Status

Description Function code 01 (0X references) is used to read a digital outputs ON/OFF status of the 7866 Analyzer/Indicator in a binary data format. All binary data transferred using function code 01is mapped into bytes. There are 3 Digital Output's available to read: DO1 = Alarm #1 DO2 = Alarm #2* DO3 = Sensor * mutually exclusive with a second current output. Broadcast is not supported. Query The query message specifies the starting Digital Output (DO) and the quantity of DOs to read. Dos are addressed starting at zero: DO1 through 3 are addressed as 0 through 2 respectively. Query message format for function code 01 Slave Address Function Code Starting Address High Starting Address Low Number DO High Number DO Low CRC CRC
Example: Read DO numbers 1 to 3 from slave at address 02. 02 01 00 00 00 02 CRC CRC Response The DO status in the response message is packed as one DO per bit of the data field. Status is indicated as: 1 = ON; 0 = OFF. The LSB of the first data byte contains the DO addressed in the query. The other DOs follow toward the high order end of this byte, and from low order to high order in subsequent bytes. If the returned DO quantity is not a multiple of eight, the remaining bits in the final data byte will be padded with zeros (toward the high order end of the byte). The byte count field specifies the quantity of data bytes returned. Response message format for function code 01 Slave Address Function Code Byte Count Data Data ... CRC CRC
Example: DOs number 1 and 3 are ON, DO#2 is off. 02 01 01 05 CRC CRC In the response the status of DOs 1 - 3 is shown as the byte value 05 hex, or 0000 0101 binary. DO 3 is the MSB of this byte, and DO 1 is the LSB. Left to right, the status of DO 3 through 1 is: OFF-OFF-OFF-OFFON-OFF-ON. Unused bits were padded with a 0.
9/01
13
4.2 Function Codes 03/04 - Read Data Registers

Description Function code 03 (4X references) or Function code 04 (3X references) is used to read the binary contents of input registers in the 7866 Analyzer/Indicator. Function codes 3 and 4 are not restricted to inputs. They may transmit alarm status, control parameters, etc. If a request is made to an address that does not exist in the map in Table 6-1, the 7866 will honor that request and return zeros for that address. This behavior will greatly enhance the bandwidth on the link vs. making several different requests for non-contiguous data elements. Broadcast is not supported. Query The query message specifies the starting register and quantity of registers to be read. Registers are addressed starting at zero: registers 1-16 are addressed as 0-15. Query message format for function code 03/04 Slave Address Function Code Starting Address High Starting Address Low Number Addresses High Number Addresses Low CRC CRC
Example: Read PV/Input Value and Output Value in addresses 1AD2-1AD4 as floating point values from a 7866 at address 02. 02 04 1A D2 00 04 CRC CRC Response The register data in the response message are packed as two bytes per register. For each register, the first byte contains the high order bits and the second contains the low order bits. The floating point values require two consecutive registers. A request for a single floating point value must be for two registers. The byte order of the floating point number is determined by the setting of the byte swap configuration value. In this example, and the examples that follow, the byte swap order is FP B. Refer to subsection 3.3. The first 16 bits of the response contain the IEEE MSB of the float value. The second 16 bits of the response contain the IEEE LSB of the float value. If the master station requests only one register at an address of a floating point value, a zero will be returned. The Modbus RTU protocol has a single byte count for function codes 03 and 04, therefore the Modbus RTU protocol can only process up to 64 floating point and 127 integer values in a single request. Response message format for function codes 03/04 Slave Address Function Code Byte Count Data Data ... CRC CRC
Example: Analog inputs #1 and #2 as floating point values where PV/Input = 98.0 and Output Value = 100.0 02 04 08 48 C4 00 00 42 C8 00 00 CRC CRC
14
9/01
4.3 Function Codes 16 (10h) - Preset Multiple Registers

Description Presets values into a sequence of holding registers (4X references). The 7866 Analyzer/Indicator does not support Broadcast. The register assignments specified in Table 6-1with an access type W can be written to via Function Code 16 (10h). Query The query message specifies the register references to be preset. Registers are addressed starting at zero: Register 1 is addressed as 0. Query message format for function code 16 (10h) Slave Address Function Code Starting Address High Start Address Low Number Addresses High Number Addresses Low Byte Count Data CRC CRC
Example: Preset Indicator Bias for Range #1 (address 1882h) to 5.00 from a 7866 at address 02. 02 10 18 82 00 02 04 40 A0 00 00 CRC CRC Response The normal response returns the slave address, function code, starting address and the quantity of registers preset. The floating point values require two consecutive addresses. A request to preset a single floating point value must be for two addresses. The byte order of the floating point number is determined by the setting of the byte swap configuration value. In this example the byte swap order is FP B. Refer to subsection 3.3. The first 16 bits of the response contain the IEEE MSB of the float value. The second 16 bits of the response contain the IEEE LSB of the float value. The Byte order is configurable See Subsection 3.3. If the master station requests only one address at an address of a floating point value the slave will respond with an illegal data address exception (See Section 5) code. Response message format for function code 16 (10h) Slave Address Function Code Starting Address High Start Address Low Number Addresses High Number Addresses Low CRC CRC
Example: Response from presetting Indicator Bias value for Range #1 (address 1882h) to 5.00 from a 7866 at address 02. 02 10 18 82 00 02 CRC CRC
9/01
15
4.4 Function Code 17 (11h) - Report 7866 Analyzer/Indicator ID

Description Function code 17 (11h) is used to report the Device Information that includes information like: Slave ID, Run Indicator status, and Device Specific data. Query The query message specifies the function code only. Query message format for function code 17 (11h) Slave Address Function Code CRC CRC
Example: Read Device ID from a slave at address 02. 02 11 CRC CRC Response The response is a record format describing the instrument. Response message format for function code 17 (11h) Slave Address Function Code Byte Count Slave ID Run Indicator Status Device Specific Data CRC CRC
Slave ID - 78 (7866 Analyzer/Indicator) (one byte) (byte 3) Run Indicator Status: (one byte) (byte 4) 00=OFF; FF=ON Device Specific Data: Device Description Model ID Device Class ID Device Mapping
Device Description: 41 4E 41 37 38 36 20 31 00 00 00 00 00 00 00 (bytes 5-20) 16 Character ASCII Message with the following format: A N A 7 8 6 6 SPACE +7 NULLs Model ID: (one byte) (byte 21) 0 = Analyzer 1 = Indicator Device Class ID: The Device Classification = 0 (one byte) (byte 22) Number of Records: 6 (byte 23)
16
9/01
Modbus RTU Exception Codes
5. Modbus RTU Exception Codes

Introduction When a master device sends a query to a slave device it expects a normal response. One of four possible events can occur from the masters query: Slave device receives the query without a communication error and can handle the query normally. It returns a normal response. Slave does not receive the query due to a communication error. No response is returned. The master program will eventually process a time-out condition for the query. Slave receives the query but detects a communication error (parity, LRC or CRC). No response is returned. The master program will eventually process a time-out condition for the query. Slave receives the query without a communication error but cannot handle it (i.e., request is to a nonexistent coil or register). The slave will return with an exception response informing the master of the nature of the error (Illegal Data Address.)
The exception response message has two fields that differentiate it from a normal response: Function Code Field: In a normal response, the slave echoes the function code of the original query in the function code field of the response. All function codes have a most-significant bit (MSB) of 0 (their values are below 80 hex). In an exception response, the slave sets the MSB of the function code to 1. This makes the function code value in an exception response exactly 80 hex higher than the value would be for a normal response. With the function codes MSB set, the masters application program can recognize the exception response and can examine the data field for the exception code. Data Field: In a normal response, the slave may return data or statistics in the data field. In an exception response, the slave returns an exception code in the data field. This defines the slave condition that caused the exception. Query Example: Internal slave error reading 2 registers starting at address 1882h from slave at slave address 02. 02 03 18 82 00 02 CRC CRC Response Example: Return MSB in Function Code byte set with Slave Device Failure (04) in the data field. 83 04 CRC CRC
9/01
17
Modbus RTU Exception Codes
Table 5-1 Modbus RTU Data Layer Status Exception Codes Exception Code 01 02 Definition Illegal Function Illegal Data Address Description The message received is not an allowable action for the addressed device. The address referenced in the function-dependent data section of the message is not valid in the addressed device. The value referenced at the addressed device location is not within range. The addressed device has not been able to process a valid message due to a bad device state. The addressed device has received a valid message and is busy reprocessing. The addressed device has rejected a message due to a busy state. Retry later. The addressed device cannot process the current message. Issue a PROGRAM POLL to obtain devicedependent error data.
03 04 05 06 07
Illegal Data Value Failure in Associated Device Acknowledge (Busy repoll) BUSY, REJECT NAK, Negative Acknowledge
18
9/01
Register Map for Process and Operation Type Variables
6. Register Map for Process and Operation Type Variables

Whats in this section? This section describes all paramters accessible by Function Code 03, 04, and 10h. Table 6-1 lists each parameter, its addresses/registers, and the details on each parameter. Your particular 7866 may not contain all parameters shown. If you see a function that is not on your 7866, either it is not available for that model or it is not in your configuration.
6.1 Register Map Overview

Conversion of Address (Hex) Number to Register (Decimal) Number To convert the address number to the register number, convert the address from hexidecimal to decimal and add 40001. Registers are addressed starting at zero: registers 1-16 are addressed as 0-15. To convert the register number to the address number, subtract 40001 from the register and convert to hex.
6.2 7866 Analyzer/Indicator Register Map

Table 6-1 7866 Register Map Addresses Address (hex) 1AD2 1AD4 1AD6 1AD8 1ADA Register (decimal) 46867 46869 46871 46873 46875 Parameter Name PV/Input Value Output Not Used Range Value High Range Low Value R R Floating Point 0 - 100.0% Floating Point 0 - 100.0% Access R R Notes Floating Point 0 - 100.0% Floating Point 0 - 100.0%
Constant Value Registers

1880 1882 1884 1886 46273 46275 46277 46279 Alarm Hysteresis (Both Alarms) Indicator Bias Value for Range #1 Indicator Bias Value for Range #2 Indicator Bias Value for Range #3 R/W R/W R/W R/W Floating Point 0 - 100.0% Floating Point +10.00 to -10.00 Floating Point +10.00 to -10.00 Floating Point +10.00 to -10.00
Alarms
1BF0 47158 Alarm Status #1 - #2 R Bit Packed Bit 0: Alarm #1 Status 0 = Alarm Off 1 = Alarm On Bit 1: Alarm #2 Status
9/01 7866 Analyzer/Indicator Modbus RTU Serial Communications User Manual 19
Register Map for Process and Operation Type Variables
Address (hex)
Register (decimal)
Parameter Name
Access
Notes 0 = Alarm Off 1 = Alarm On Bits 2, through 7 are unused and return a 0 value.
1C00
47169
Alarm 1 Setpoint Value* Low Alarm Type Triple Range - Range 3 only Alarm 2 Setpoint Value* High Alarm type for Single Range Low Alarm type for Triple Range - Range 3
R/W
Floating Point 90.0 to 100.0%
1C02
47171
R/W
Floating Point 90.0 to 100.0%
* For Single Range Analyzer, Alarm 1 and 2 Setpoint range limit is set internally to that of the input type
20
9/01
Function Codes 14h(20) and 15h(21)
7. Analyzer/Indicator Configuration Messages (Function Codes 14h(20) and 15h(21)

7.1 General Information
This section describes function codes 14h(20) and 15h(21) which provide additional functionality not available using the function codes described in the previous sections. The additional functionality includes: Read/Write dynamic data that is not part of the function code 04 register set Read/Write device data that are not part of the function code 03 register set
For Function Codes 14h(20) and 15h(21), the Byte Swap configuration does not apply. All numbers are represented in the FP B byte order. Refer to Subsection 3.3. All digital numbers are represented as Floating Point 0 for OFF and Floating Point 1 for ON. Configuration ID Tags The UDC2300 function codes 20 and 21 use the RS422/485 tag Ids (decimal) for accessing configuration and process-related data. These tags are fully explained in Table 7-3 and Table 7-4. The tag IDs represent the register addresses used in the Request Message. Register Address Structure The file number word contains the register number from the register address structure tables. Although the register address structure tables (Table 7-1 and Table 7-2) indicate up to 13 data registers are available for access, only register address 3 is currently supported. Table 7-1 Register Address Structure - Integer Parameter Type Register Numbers (Dec)
1 2 3 4 5 6 7 8 9 to 13 Type = 1 Attribute Value (16 bit integer) Not Used Low Range (16 bit integer) Not Used High Range (16 bit Integer) Not Used Description Text (ASCII string)
Name
Access
Notes
NOT SUPPORTED NOT SUPPORTED Read / Write NOT SUPPORTED NOT SUPPORTED NOT SUPPORTED NOT SUPPORTED NOT SUPPORTED NOT SUPPORTED
16-bit Unsigned Integer 1 = Read Only, 2 = Read/Write
9/01
21
Table 7-2 Register Address Structure - Floating Point Parameter Type Register Numbers (Dec)
1 2 3 4 5 6 7 8 9 to 13 Type = 2 Attribute Value (float high word) Value (float low word) Low Range (float high word) Low Range (float low word) High Range (float high word) High Range (float low word) Description Text (ASCII string)
Name
Access
Notes
NOT SUPPORTED NOT SUPPORTED Read / Write NOT SUPPORTED NOT SUPPORTED NOT SUPPORTED NOT SUPPORTED NOT SUPPORTED NOT SUPPORTED
IEEE Floating Point 1 = Read Only, 2 = Read/Write
Register Count The register count depends on the data format of the registers being read or written. Integer data is represented in sixteen bits and is transferred high byte first. Floating point data is transferred in IEEE 32-bit format. The register count definitions are: 0001 = Integer Data 0002 = Floating Point Data Configuration ID Tags Function Codes 20 and 21 use local addressing to read and write parameters that are for Analog or Digital. Table 7-3 and Table 7-4 lists all the register addresses and ranges or selections for the parameters in the 7866 Analyzer/Indicator. Table 7-3 Analog Parameter Register Addresses Parameter Description Register Address Hex Analog Parameters Alarm 1 Setpoint Alarm 2 Setpoint Alarm Hysteresis Indicator Bias Value for Range 1 Indicator Bias Value for Range 2 Indicator Bias Value for Range 3 0001 0002 0003 0004 0005 0006 001 002 003 004 005 006 FP FP FP FP FP FP R/W R/W R/W R/W R/W R/W 90.0 to 100.0 90.0 to 100.0 0 to 100.0 +10.00 to 10.00 +10.00 to 10.00 +10.00 to 10.00 Decimal (Tag ID) Data Type Access Data Range or Enumerated Selection
22
9/01
Table 7-4 Digital Parameter Register Addresses Parameter Description Register Address Hex Digital Parameters Analyzer Type Input Selections for Single Range Units Output Selections Power Frequency Lockout Level 0080 0081 0082 0083 0084 128 129 130 131 132 INT INT INT INT INT R R R/W R/W R/W 0 = Triple Range 1 = Single Range See enumerated Range selection in Table 7-5. 0 = 4 to 20mA 1 = 0 to 20mA 0 = 60 cycles 1 = 50 cycles 0 = None 1 = Calibration 2 = Unit 3 = View 1 = One place 2 = Two places 0 = Range 1 1 = Range 2 2 = Range 3 0 = Indicator 1 = Analyzer 0 = 1 to 5 V (4-20mA) 1 = 0 to 5 V (0-20mA) Decimal (Tag ID) Data Type Access Data Range or Enumerated Selection
Decimal Point Location Range Selection
0085 0086
133 134
INT INT
R/W R
Model Type PV Input Actuation
0087 0088
135 136
INT INT
R R/W
9/01
23
Table 7-5 Range and Type Enumeration 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 01 02 05 0 10 0 15 0 20 0 30 0 75 0 100 50 100 80 100 85 100 90 100 95 100 98 100 60 80 40 80 45 55 20 50 0 10 0 15 0 20 0 30 0 40 0 100 Range and Type When measuring %H2 in Air, N2, or O2; %H2 When measuring %H2 in Air, N2, or O2; %H2 When measuring %H2 in Air, N2, or O2; %H2 When measuring %H2 in Air, N2, or O2; %H2 When measuring %H2 in Air, N2, or O2; %H2 When measuring %H2 in Air, N2, or O2; %H2 When measuring %H2 in Air, N2, or O2; %H2 When measuring %H2 in Air, N2, or O2; %H2 When measuring %H2 in Air, N2, or O2; %H2 When measuring %H2 in Air, N2, or O2; %H2 When measuring %H2 in Air, N2, or O2; %H2 When measuring %H2 in Air, N2, or O2; %H2 When measuring %H2 in Air, N2, or O2; %H2 When measuring %H2 in Air, N2, or O2; %H2 When measuring %H2 in Air, N2, or O2; %H2 When measuring %H2 in Air, N2, or O2; %H2 When measuring %H2 in Air, N2, or O2; %H2 When measuring %H2 in Air, N2, or O2; %H2 When measuring %H2 in Air, N2, or O2; %H2 When measuring %CO2 in Air, N2, or O2; %CO2 When measuring %CO2 in Air, N2, or O2; %CO2 When measuring %CO2 in Air, N2, or O2; %CO2 When measuring %CO2 in Air, N2, or O2; %CO2 When measuring %CO2 in Air, N2, or O2; %CO2 When measuring %CO2 in Air, N2, or O2; %CO2
When measuring 0 100%H2 in CO2 When measuring 50 100%H2 in CH4 When measuring 0 100%He in Air When measuring 0 30%CH4 in H2 When measuring 5 15%CH4 in Air When measuring 95 100%O2 in H2 Special Application: 0 75% dissociated ammonia
24
9/01
7.2 Function Code 20 (14h) - Read Configuration Reference Data

Description Function code 20 (14 Hex) is used to read information stored in the 7866 configuration database. Each configuration item is explicitly addressed by a file number and register address. IEEE 32-bit floating point and 16-bit integer formats are supported. Request and Response Formats The Request and Response formats for Function code 20 (14 Hex) are shown below. Details for each block reference follow. Request Message Format
Slave Address Function Code 14 Byte Count Reference Type File Number Register Address Register Count
Reference Type Type
File Number
Register Address
Register Count
CRC Data
CRC Data
Response Message Format

Slave Address Function Code 14 Byte Count Data Byte Count Reference Type Data Data Data
Reference Data Type
Data Byte Count
Reference Type
Data
Data
Data
Data
CRC Data
CRC Data
Byte Count The Byte Count equals the number of bytes transmitted in either the request or response message and will be the minimum number required to transmit all requested data. Data Byte Count The Data Byte Count is the number of data bytes of the sub response including the Reference Type but not including itself. A floating point sub response has four bytes of data and one byte representing the reference type making the data byte count equal to five. Reference Type Definitions The Reference Type definition is always 06.
9/01
25
File Number The file number word contains the register number from the register address structure tables on page 21. Although the register address structure tables indicate up to 13 data registers are available for access, only register address 3 is currently supported. Register Address The register address is used to designate the tag ID number for the parameter being accessed. The register address is made up of two bytesthe MSB = 00 always. The LSB contains the RS422 tag ID number. The tag ID numbers represent the parameters register address(es). Table 7-6 Register Address Format for Function Code 20 Register Address(es) (Decimal) 001 to 006 128 to 136 Register Address(es) (Hex) 0001 to 0006 0080 to 0088 Format
analog formatted data (2 registers IEEE 32-bit floating point) integer formatted data (1 register 16-bit integer)
Example #1 The following is an example of a request to read the Output Type using Function code 20. Request Message (Read (Output Type) = ID Tag 130) 05 14 07 06 00 03 00 82 00 01 Where: 05 14 07 06 00 03 00 82 00 01 = = = = = = = Address Function Code 20 (14 hex) Byte Count Reference Type File Number (Standard Access /Output Type Tag ID #130) Register Address (Access Data Value) Register Count (Integer Data)
This is the response to the above request. Response Message 05 14 04 03 06 00 01 (CRC16) Where: 05 14 04 03 06 00 01 (CRC16) = = = = = = Address Function Code 20 (14 Hex) Byte Count Sub Message Length Reference Type 4 to 20mA (Output Type)
26
9/01
Example #2 The following is another example of a request and response message using Function code 20. Request Message (Read Alarm Hysteresis = ID Tag 3) 06 14 07 06 00 03 00 03 00 02 Where: 06 14 07 06 00,03 00,03 00,02 = = = = = = = Address Function Code 20 (14 Hex) Byte Count Reference Type (IEEE Floating Point) File Number (Access Data Value) Register Address (Standard Access Alarm Hysteresis - ID Tag 3) Register Count to read (Floating Point Data)
This is the response to the above request. Response Message 06 14 06 05 06 3F 00 00 00 (CRC16) Where: 02 14 06 05 06 3F 00 00 00 (CRC16) = = = = = = Address Function Code 20 (14 Hex) Byte Count Data Byte Count (Sub Message Length) Reference Type (IEEE Floating Point) 0.5 (Value of Hysteresis)
9/01
27
Example #3 The following is an example of a request to read the Alarm 2 Setpoint value using Function code 20. Request Message (Read (Alarm 2 Setpoint) = ID Tag 002) 02 14 07 06 00 03 01 01 00 02 (CRC16) Where: 02 14 07 06 00,03 00,02 00 02 (CRC16) = = = = = = = Address Function Code 20 (14 hex) Byte Count Reference Type File Number (Access Data Value) Register Address (Standard Access / Alarm 2 Setpoint Tag ID #2) Register Count (Floating Point Data)
This is the response to the above request. Response Message 02 14 06 05 06 41 88 00 00 (CRC16) Where: 02 14 06 05 06 41 88 00 00 (CRC16) = = = = = = Address Function Code 20 (14 Hex) Byte Count Sub Message Length Reference Type (IEEE Floating Point) 17.00 (Value of Alarm 2 Setpoint)
28
9/01
7.3 Function Code 21 (15h) - Write Configuration Reference Data

Introduction Function Code 21 (15 Hex) is used to allow writes of integer and floating point values to the 7866 configuration database and override values. The configuration database is located in EEROM. The override values are stored in RAM. Integer format is used to write to Digital configuration items. Floating Point format is used to write to Analog configuration items as defined by the configuration ID tags. Write Restrictions Care should be taken not to exceed the 10,000 write limit of the EEROM. Request and Response Formats The Request and Response formats for Function code 21 (15 Hex) are shown below. Details for each block reference follow. Request Message Format
Data
Data
Data
Data
File Number
CRC Data
CRC Data
Response Message Format (echo back of request)

Data
Data
Data
Data
File Number
CRC Data
CRC Data
Reference Type Definitions The Reference Type definition is always 06. Byte Count The Byte Count equals the number of bytes transmitted in either the request or response message and will be the minimum number required to transmit all requested data. File Number The file number word contains the register number from the register address structure tables on page 21. Although the register address structure tables indicate up to 13 data registers are available for access, only register address 3 is currently supported.
9/01 7866 Analyzer/Indicator Modbus RTU Serial Communications User Manual 29
Register Address The register address is used to designate the tag ID number for the parameter being accessed. The register address is made up of two bytesthe MSB = 00 always. The LSB contains the RS422 tag ID number. The tag ID numbers represent the parameters register address(es). Table 7-7 Register Address Format for Function Code 21 Register Address(es) (Dec) 001 to 006 Register Address(es) (Hex) 0001 to 0006 Format
analog formatted data (2 registers IEEE 32-bit floating point)
128 to 136
0080 to 0088
integer formatted data (1 register 16-bit integer)
Restrictions on Parameter Numbers in One Message The maximum number of writeable parameters per write request is 1. Example #1 The following is an example of a request to write the Alarm 1 Setpoint value using Function code 21 (15 Hex). Request Message (Write Alarm 1 Setpoint = 15 ID Tag 1) 02 15 0B 06 00 03 00 01 00 02 41 70 00 00 (CRC16) Where: 02 15 0B 06 00 03 00 01 00 02 41 70 00 00 (CRC16) = = = = = = = = Address Function Code 21 (15 Hex) Byte Count Reference Type (IEEE Floating Point) File Number (Access Data Value) Register Address (Standard Access/ Alarm 1 Setpoint) Register Count (Floating Point Data) 15.00
This is the response to the above request. Response Message (The response is an echo of the request) 02 15 0b 06 00 03 00 01 00 02 41 70 00 00 (CRC16)
30
9/01
Example #2 The following is an example of a request to write the Indicator Bias value for Range 3 using Function code 21 (15 Hex). Request Message (Write Indicator Bias Value for Range 3 = 3.0 ID Tag 6) 02 15 0B 06 00 03 00 06 00 02 40 40 00 00 (CRC16) Where: 02 15 0B 06 00 03 00 06 00 02 40 40 00 00 (CRC16) = = = = = = = = Address Function Code 21 (15 Hex) Byte Count Reference Type (IEEE Floating Point) File Number (Access Data Value) Register Address (Standard Access/ Indicator Bias Value - ID Tag 6) Register Count (Floating Point Data) 3.00
This is the response to the above request. Response Message (The response is an echo of the request) 02 15 0B 06 00 03 00 06 00 02 40 40 00 00 (CRC16)
Example #3 The following is an example of a request to write the Output Type of 4-20mA using Function code 21 (15 Hex). Request Message (Write Output Type = 4-20mA ( ID Tag 130) 02 15 09 06 00 03 00 82 00 01 00 01 (CRC16) Where: 02 15 09 06 00 03 00 82 00 01 00 01 (CRC16) = = = = = = = = Address Function Code 21 (15 Hex) Byte Count Reference Type (IEEE Floating Point) File Number (Access Data Value) Register Address (Standard Access/ Output Type- ID Tag 130) Register Count (Floating Point Data) 4-20mA
This is the response to the above request. Response Message (The response is an echo of the request) 02 15 09 06 00 03 00 82 00 01 00 01 (CRC16)
9/01
31
Appendix: CRC-16 Calculation
8. Appendix: CRC-16 Calculation

See following function: extern void calculate_CRC(unsigned char *message, int length, unsigned char *CRC) { unsigned char CRCHi, CRCLo, TempHi, TempLo; static const unsigned char table[512] = {
0x00, 0xC6, 0xCC, 0x0A, 0xD8, 0x1E, 0x14, 0xD2, 0xF0, 0x36, 0x3C, 0xFA, 0x28, 0xEE, 0xE4, 0x22, 0xA0, 0x66, 0x6C, 0xAA, 0x78, 0xBE, 0xB4, 0x72, 0x50, 0x96, 0x9C, 0x5A, 0x88, 0x4E, 0x44, 0x82, 0x00, 0x01, 0x01, 0x00, 0x01, 0x00, 0x00, 0x01, 0x01, 0x00, 0x00, 0x01, 0x00, 0x01, 0x01, 0x00, 0x01, 0x00, 0x00, 0x01, 0x00, 0x01, 0x01, 0x00, 0x00, 0x01, 0x01, 0x00, 0x01, 0x00, 0x00, 0x01, 0xC0, 0x06, 0x0C, 0xCA, 0x18, 0xDE, 0xD4, 0x12, 0x30, 0xF6, 0xFC, 0x3A, 0xE8, 0x2E, 0x24, 0xE2, 0x60, 0xA6, 0xAC, 0x6A, 0xB8, 0x7E, 0x74, 0xB2, 0x90, 0x56, 0x5C, 0x9A, 0x48, 0x8E, 0x84, 0x42, 0xC1, 0xC0, 0xC0, 0xC1, 0xC0, 0xC1, 0xC1, 0xC0, 0xC0, 0xC1, 0xC1, 0xC0, 0xC1, 0xC0, 0xC0, 0xC1, 0xC0, 0xC1, 0xC1, 0xC0, 0xC1, 0xC0, 0xC0, 0xC1, 0xC1, 0xC0, 0xC0, 0xC1, 0xC0, 0xC1, 0xC1, 0xC0, 0xC1, 0x07, 0x0D, 0xCB, 0x19, 0xDF, 0xD5, 0x13, 0x31, 0xF7, 0xFD, 0x3B, 0xE9, 0x2F, 0x25, 0xE3, 0x61, 0xA7, 0xAD, 0x6B, 0xB9, 0x7F, 0x75, 0xB3, 0x91, 0x57, 0x5D, 0x9B, 0x49, 0x8F, 0x85, 0x43, 0x81, 0x80, 0x80, 0x81, 0x80, 0x81, 0x81, 0x80, 0x80, 0x81, 0x81, 0x80, 0x81, 0x80, 0x80, 0x81, 0x80, 0x81, 0x81, 0x80, 0x81, 0x80, 0x80, 0x81, 0x81, 0x80, 0x80, 0x81, 0x80, 0x81, 0x81, 0x80, 0x01, 0xC7, 0xCD, 0x0B, 0xD9, 0x1F, 0x15, 0xD3, 0xF1, 0x37, 0x3D, 0xFB, 0x29, 0xEF, 0xE5, 0x23, 0xA1, 0x67, 0x6D, 0xAB, 0x79, 0xBF, 0xB5, 0x73, 0x51, 0x97, 0x9D, 0x5B, 0x89, 0x4F, 0x45, 0x83, 0x40, 0x41, 0x41, 0x40, 0x41, 0x40, 0x40, 0x41, 0x41, 0x40, 0x40, 0x41, 0x40, 0x41, 0x41, 0x40, 0x41, 0x40, 0x40, 0x41, 0x40, 0x41, 0x41, 0x40, 0x40, 0x41, 0x41, 0x40, 0x41, 0x40, 0x40, 0x41, 0xC3, 0x05, 0x0F, 0xC9, 0x1B, 0xDD, 0xD7, 0x11, 0x33, 0xF5, 0xFF, 0x39, 0xEB, 0x2D, 0x27, 0xE1, 0x63, 0xA5, 0xAF, 0x69, 0xBB, 0x7D, 0x77, 0xB1, 0x93, 0x55, 0x5F, 0x99, 0x4B, 0x8D, 0x87, 0x41, 0x01, 0x00, 0x00, 0x01, 0x00, 0x01, 0x01, 0x00, 0x00, 0x01, 0x01, 0x00, 0x01, 0x00, 0x00, 0x01, 0x00, 0x01, 0x01, 0x00, 0x01, 0x00, 0x00, 0x01, 0x01, 0x00, 0x00, 0x01, 0x00, 0x01, 0x01, 0x00, 0x03, 0xC5, 0xCF, 0x09, 0xDB, 0x1D, 0x17, 0xD1, 0xF3, 0x35, 0x3F, 0xF9, 0x2B, 0xED, 0xE7, 0x21, 0xA3, 0x65, 0x6F, 0xA9, 0x7B, 0xBD, 0xB7, 0x71, 0x53, 0x95, 0x9F, 0x59, 0x8B, 0x4D, 0x47, 0x81, 0xC0, 0xC1, 0xC1, 0xC0, 0xC1, 0xC0, 0xC0, 0xC1, 0xC1, 0xC0, 0xC0, 0xC1, 0xC0, 0xC1, 0xC1, 0xC0, 0xC1, 0xC0, 0xC0, 0xC1, 0xC0, 0xC1, 0xC1, 0xC0, 0xC0, 0xC1, 0xC1, 0xC0, 0xC1, 0xC0, 0xC0, 0xC1, 0x02, 0xC4, 0xCE, 0x08, 0xDA, 0x1C, 0x16, 0xD0, 0xF2, 0x34, 0x3E, 0xF8, 0x2A, 0xEC, 0xE6, 0x20, 0xA2, 0x64, 0x6E, 0xA8, 0x7A, 0xBC, 0xB6, 0x70, 0x52, 0x94, 0x9E, 0x58, 0x8A, 0x4C, 0x46, 0x80, 0x80, 0x81, 0x81, 0x80, 0x81, 0x80, 0x80, 0x81, 0x81, 0x80, 0x80, 0x81, 0x80, 0x81, 0x81, 0x80, 0x81, 0x80, 0x80, 0x81, 0x80, 0x81, 0x81, 0x80, 0x80, 0x81, 0x81, 0x80, 0x81, 0x80, 0x80, 0x81, 0xC2, 0x04, 0x0E, 0xC8, 0x1A, 0xDC, 0xD6, 0x10, 0x32, 0xF4, 0xFE, 0x38, 0xEA, 0x2C, 0x26, 0xE0, 0x62, 0xA4, 0xAE, 0x68, 0xBA, 0x7C, 0x76, 0xB0, 0x92, 0x54, 0x5E, 0x98, 0x4A, 0x8C, 0x86, 0x40, 0x41, 0x40, 0x40, 0x41, 0x40, 0x41, 0x41, 0x40, 0x40, 0x41, 0x41, 0x40, 0x41, 0x40, 0x40, 0x41, 0x40, 0x41, 0x41, 0x40, 0x41, 0x40, 0x40, 0x41, 0x41, 0x40, 0x40, 0x41, 0x40, 0x41, 0x41, 0x40,
}; CRCHi = 0xff; CRCLo = 0xff; while(length) { TempHi = CRCHi; TempLo = CRCLo; CRCHi = table[2 * (*message ^ TempLo)]; CRCLo = TempHi ^ table[(2 * (*message ^ TempLo)) + 1]; message++; length--; }; CRC [0] = CRCLo; CRC [1] = CRCHi; return; }
32
9/01
Index
Index
A
Acknowledge (Busy repoll), 18 Alarm #1, 13 Alarm #2, 13 Alarm 1 Setpoint, 22 Alarm 1 Setpoint Value, 20 Alarm 2 Setpoint, 22 Alarm 2 Setpoint Value, 20 Alarm Hysteresis, 19, 22 Alarm Status #1 - #2, 19 Analog Parameters, 22 Analyzer Type, 23 Floating Point Little Endian, 9 Floating Point Little Endian with byte-swapped, 9 Function code 01, 13 Function code 03, 14 Function Code 03, 04, and 10h, 19 Function code 04, 14 Function Code 16 (10h), 15 Function code 17 (11h), 16 Function code 20 (14 Hex), 25 Function Code 21 (15 Hex), 29 Function Code Field, 17 Function Codes, 12 function codes 20 and 21, 1, 21 Function Codes 20 and 21, 1 Function Codes Definitions, 12
B
Bit transfer order, 5 Bit transfer rate, 5 Bits per character, 5 Broadcast, 13 Byte Count, 25, 29 Byte Swapping, 9
H
High Alarm type for Single Range, 20
I,J,K
IEEE 32-bit Floating Point Register, 7 IEEE Floating Point Formats, 10 IEEE Floating Point Number Examples in FP B Format, 11 Illegal Data Address, 18 Illegal Data Value, 18 Illegal Function, 18 Implementation, 1 Indicator Bias Value, 19 Indicator Bias Value for Range 1, 22 Indicator Bias Value for Range 2, 22 Indicator Bias Value for Range 3, 22 Input Selections for Single Range Units, 23 Integer Formatted data, 12
C
Coding system, 5 Communications Wiring, 3 Configuration ID Tags, 21, 22 Constant Value Registers, 19 Conversion of Address (Hex) Number to Register (Decimal) Number, 19 CRC-16 Calculation, 32
D
Data Byte Count, 25 Data Field, 17 Data Layer, 6 Decimal Point Location, 23 Device Class ID, 16 Device Description, 16 Device Specific Data, 16 Digital Parameters, 23 Duplex, 5
L
Link Layer, 5 Lockout Level, 23 Low Alarm Type, 20 Low Alarm type for Triple Range, 20
E
End of message, 5 Error checking, 5 Exception Codes, 17, 18 Exponent, 8
M
Mantissa and Sign, 7 Message format, 6 Message Formats, 5 Miscellaneous Register Map Addresses, 19 Modbus Communications Group, 9 Modbus Double Register Format, 9 Model ID, 16 Model Type, 23
F,G
File Number, 26, 30 File number word, 21 Floating Point Big Endian, 9 Floating Point Big Endian with byte-swapped, 9 Floating point formatted data, 12
9/01
33
Index
N
Negative Acknowledge, 18 Number of Records, 16
O
Output, 19 Output Selections, 23
P
Parity, 5 Polynomial, 5 Power Frequency, 23 Preset Multiple Registers, 12, 15 PV/Input Value, 19
Q
Query message format for function code 01, 13 Query message format for function code 03/04, 14 Query message format for function code 16 (10h), 15 Query message format for function code 17 (11h), 16
R
Range Low Value, 19 Range Selection, 23 Range Value High, 19 Read bit mapped data - digital outputs, 12 Read configuration data, 12 Read Data Registers, 14 Read Digital Output Status, 13 Read Discrete Outputs, 12 Read General Reference, 12 Read Holding Registers, 12 Read Input Registers, 12 Read instrument specific data, 12 Reference Type Definitions, 25, 29 Register Address, 26, 30 Register Address Format for Function Code 20, 26 Register Address Format for Function Code 21, 30
Register Address Structure, 21 Register Address Structure - Floating Point Parameter Type, 22 Register Address Structure - Integer Parameter Type, 21 Register Count, 22 Register Map, 19 Report 7866 Analyzer/Indicator ID, 16 Report Device ID, 12 Request and Response formats for Function code 20 (14 Hex), 25 Request and Response formats for Function code 21 (15 Hex), 29 Reserved Operands, 9 Response message format for function code 01, 13 Response message format for function code 16 (10h), 15 Response message format for function code 17 (11h), 16 Response message format for function codes 03/04, 14 Restrictions on Parameter, 30 RS485 to RS232 converter, 3 Run Indicator Status, 16
S
Sensor, 13 Slave Device Failure, 18 Slave ID, 16
T
The register address structure tables, 26
W,X,Y,Z
Write configuration data, 12 Write Configuration Reference Data, 29 Write floating point formatted data, 12 Write General Reference, 12
34
9/01
Sensing and Control Honeywell 11 West Spring Street Freeport, IL 61032

51-52-25-104 0901 Printed in USA
www.honeywell.com/sensing

7866 Gas Analyzer/Indicator Modbus® RTU Serial Communications User Manual

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

7866 Gas Analyzer/Indicator Modbus® RTU Serial Communications User Manual

Uploaded by

Copyright:

Available Formats

7866 Gas Analyzer/Indicator Modbus RTU Serial Communications User Manual

Sensing and Control

Copyright, Notices, and Trademarks

Sensing and Control Honeywell 11 West Spring Street Freeport, IL 61032

Reference: Modicon Modbus Protocol Reference Guide - PI-MBUS-300 Rev. G

7866 Analyzer/Indicator Modbus RTU Serial Communications User Manual

About This Document

Telephone Contact us by telephone at the numbers listed below.

Asia Pacific Europe Latin America

7866 Analyzer/Indicator Modbus RTU Serial Communications User Manual

MODBUS RTU MESSAGE FORMAT.................................................................... 5

MODBUS RTU FUNCTION CODES ................................................................... 12

ANALYZER/INDICATOR CONFIGURATION MESSAGES (FUNCTION CODES 14H(20) AND 15H(21) ...................................................... 21

APPENDIX: CRC-16 CALCULATION ................................................................. 32

7866 Analyzer/Indicator Modbus RTU Serial Communications User Manual

7866 Analyzer/Indicator Modbus RTU Serial Communications User Manual

7866 Analyzer/Indicator Modbus RTU Serial Communications User Manual

7866 Analyzer/Indicator Modbus RTU Serial Communications User Manual

MODBUS OR RS422/485 HALF DUPLEX

Master SHD TX+/RX+ TX/RX

CAUTION Do not mix half and full duplex wiring.

To Other Communication Instruments (maximum 15)

Do not run these lines in the same conduit as AC power

120 Ohm Resistor on Last Leg

MODBUS OR RS422/485 FULL DUPLEX

Master SHD TX+ TX RX+ RX

Do not run these

Figure 2-1 7866 Analyzer/Indicator Communications wiring

7866 Analyzer/Indicator Modbus RTU Serial Communications User Manual

7866 Analyzer/Indicator Modbus RTU Serial Communications User Manual

Modbus RTU Message Format

3. Modbus RTU Message Format

3.1 Modbus RTU Link Layer

7866 Analyzer/Indicator Modbus RTU Serial Communications User Manual

Modbus RTU Message Format

3.2 Modbus RTU Data Layer

7866 Analyzer/Indicator Modbus RTU Serial Communications User Manual

Modbus RTU Message Format

3.3 IEEE 32-bit Floating Point Register Information

3.3.1 IEEE Floating Point Data Format

Add an implied value of one to the left of the binary point:

Using positioned notation, this binary number is equal to:

10 + (1x2 -1 ) + (0x2 -2 ) + (0x2 -3 ) + (1x2 -4 ) = 10 + 0.5 + 0.0 + 0.0 + 0.0625 = 15625 . . .

7866 Analyzer/Indicator Modbus RTU Serial Communications User Manual

Modbus RTU Message Format

Removing the sign and mantissa bits, the exponent becomes:

1x2 7 + 0x2 6 + 0x2 5 + 0x2 4 + 0x2 3 + 1x2 2 + 0x2 1 + 1x2 0

float number = mantissa x 2 exponent float number = 1.5625 x 2 6 = 15625 x 64 = 100.0 .

DECIMAL 100.0 -100.0 0.5 -1.75 0.0625 1 0

HEXADECIMAL 42C80000 C2C80000 3F000000 BFE00000 3D800000 3F800000 00000000

7866 Analyzer/Indicator Modbus RTU Serial Communications User Manual

Modbus RTU Message Format

EXCEPTION +/- Infinity Not-a-Number (NAN) Denormalized Number Zero

EXPONENT All 1s All 1s All 0s All 0s

MANTISSA All 0s Other than 0s Other than 0s All 0s

3.3.2 Modbus Double Register Format

7866 Analyzer/Indicator Modbus RTU Serial Communications User Manual

Modbus RTU Message Format

IEEE Floating Point Formats

FP B - Floating Point Big Endian Format:

M15 M14 M13 M12 M11 M10 M9 M8

S=Sign E=Exponent M=Mantissa