HC900 Hybrid Controller Communications User Guide 51-52-25-111 9/03 Revision: 4 Industrial Measurement and Control
Copyright, Notices, and Trademarks Printed in U.S.A. – © Copyright 2003 by Honeywell Revision 4 – 9/03 Warranty/Remedy Honeywell warrants goods of its manufacture as being free of defective materials and faulty workmanship. Contact your local sales office for warranty information. If warranted goods are returned to Honeywell during the period of coverage, Honeywell will repair or replace without charge those items it finds defective.
About This Document Abstract This document provides information specific to the communications interface for Honeywell’s HC900 Controller. The protocol supported for connection to the controller’s Ethernet network port is Modbus/TCP (Modbus RTU protocol in a TCP/IP wrapper). . The document includes a summary of all HC900 data available (primarily floating point) for Modbus RTU access read and write including methods for access.
Contents 1. INTRODUCTION ................................................................................................... 1 1.1 Modbus/TCP Interface ................................................................................................................... 1 1.2 Modbus RTU RS232/RS485 Communication Ports ...................................................................... 4 2. IEEE 32-BIT FLOATING POINT REGISTER INFORMATION.............................. 7 2.1 3.
6.10 Set Point Program Register Maps ............................................................................................. 53 6.11 Set Point Programmer Value Register Map.............................................................................. 56 6.12 Set Point Programmer Additional Values Register Map .......................................................... 58 6.13 Set Point Programmer Segment Map........................................................................................
Tables Table 1-1 Modbus RTU Message Formats ________________________________________________ 5 Table 3-1 Modbus Double Register Format Selections ______________________________________ 10 Table 3-2 IEEE Floating Point Number Examples in FP B Format ____________________________ 12 Table 4-1 Modbus/TCP and Modbus RTU Function Codes Definitions_________________________ 17 Table 4-2 Maximum Number of Object Addresses _________________________________________ 18 Table 4-3 Maximum Number of Registers Allowable pe
Figures Figure 1-1 Figure 1-2 Figure 2-1 Figure 3-1 Revision 4 9/03 Modbus RTU Protocol within a TCP/IP Frame ____________________________________ 2 Ethernet 10Base-T Network Connections ________________________________________ 4 IEEE Floating Point Data format _______________________________________________ 7 IEEE Floating Point Formats _________________________________________________ 12 HC900 Hybrid Controller Communications User Guide vii
Introduction Overview 1. Introduction 1.1 Overview The HC900 controller provides Modbus communication support on three communication interfaces. • Network port: Modbus TCP on an Ethernet connection • RS232 port: Modbus RTU • RS485 port: Modbus RTU The user may find it convenient to print out the Modbus addresses for various parameters of the configuration (signal tags, PID loops, SP programmer, etc.) using the HC Designer report functions. With HC Designer Ver. 2.
Introduction Modbus/TCP Interface Figure 1-1 Modbus RTU Protocol within a TCP/IP Frame The Open Modbus/TCP Specification is followed with respect to the physical, data link, and network layers. The message structure within the Modbus frame uses standard Modbus RTU function codes. The Address part of the Modbus frame is not used (set to 00) since there is no sub-addressing intended or required. The controller IP address is the identifying address, set independently at the controller.
Introduction Modbus/TCP Interface Subnet Mask (if other than default, 255.255.255.0), and Default Gateway IP address (if required, otherwise leave at default 0.0.0.0). See your IT network administrator for proper entries. (Refer to the on-line help provided with the HC Designer software, Utilities Worksheet, Set Controller’s Network Parameters, for further details on this step). Note: This setup will require the controller to be placed temporarily in the Program mode.
Introduction Modbus RTU RS232/RS485 Communication Ports Ethernet 10Base-T Network Connections Ethernet 10Base-T networks operating at 10MB/sec. are supported. A typical network arrangement is as shown below. Figure 1-2 Ethernet 10Base-T Network Connections Setting Up the Modbus/TCP Double Register Format The HC900 predominantly uses an IEEE floating point format for communicating data to software applications providing Modbus/TCP protocol communications drivers.
Introduction Modbus RTU RS232/RS485 Communication Ports These instruments DO NOT emulate any MODICON type device. The Modbus RTU specification is respected in the physical and data link layers. The message structure of the Modbus RTU function codes is employed and standard IEEE 32-bit floating point and integer formats are used. Data register mapping is unique to these instruments.
Introduction Modbus RTU RS232/RS485 Communication Ports General Modbus RTU message format Query message format [Slave Address, Function Code, Function code dependent data, CRC 16] Response message format [Slave Address, Function Code*, Function code dependent data, CRC 16] * If an error is detected in a valid message the response function code is modified by adding 80 (hex) and the function code dependent data is replaced by an exception response code as described in 5. Modbus RTU Exception Codes .
IEEE 32-bit Floating Point Register Information IEEE Floating Point Data Format 2. IEEE 32-bit Floating Point Register Information The Modbus interface supports IEEE 32-bit floating point information for several of the function codes. 2.1 IEEE Floating Point Data Format The formula for calculating the floating point number is: mantissa x 2 (exponent -127) (23 bit signed binary with 8 bit biased binary exponent) byte 4 byte 3 3 2 2 1 1 4 3 6 xxxxxxxx x.
IEEE 32-bit Floating Point Register Information IEEE Floating Point Data Format Exponent The exponent is defined by an unsigned 8-bit binary value (bits 23 through 30). The value of the exponent is derived by performing a signed subtraction of 127 (decimal) from the 8-bit exponent value.
IEEE 32-bit Floating Point Register Information IEEE Floating Point Data Format Reserved Operands Per the Standard certain exceptional forms of floating point operands are excluded from the numbering system.
Modbus Double Register Format IEEE Floating Point Data Format 3. Modbus Double Register Format Data that is 32 bits requires 2 sequential registers (4 bytes) to transfer its data. Data of this type includes IEEE 32bit floating point, 32-bit signed integer and 32-bit unsigned integer. The stuffing order of the bytes into the two registers differs among Modbus/TCP hosts. To provide compatibility, the double register format for the HC900 controller is configurable.
Modbus Double Register Format IEEE Floating Point Formats 3.
Modbus Double Register Format IEEE Floating Point Formats FP L - Floating Point Little Endian Format: Bit 15 Bit 8 S E7 E6 E5 E4 E3 E2 E1 M15 M14 M13 M12 M11 M10 M9 M8 Bit 7 E0 M22 M21M20 M19 M18 M17 M16 M7 M6 M5 M4 M3 M2 M1 M0 High Bit 16 Bit 23 Bit 0 Bit 24 Bit 31 Low High Low REGISTER N+1 (Low) REGISTER N (High) S=Sign E=Exponent M=Mantissa FP LB - Floating Point Little Endian with Byte Swapped Format: Bit 7 M7 M6 M5 M4 M3 M2 M1 M0 Bit 15 Bit 8 E0 M22 M21M20 M19 M18 M17 M16 Bit 24
Modbus Double Register Format Unsigned/signed 32-bit Register Formats 3.2 Unsigned/signed 32-bit Register Formats The formats descriptions below use the value 12345678 Hex as an example.
Modbus Double Register Format Unsigned/signed 32-bit Register Formats FP BB – Big Endian Byte Swapped Format The value 12345678 Hex will be represented as follows: Bit 23 Bit 16 Bit 31 Bit 7 Bit 0 Byte 3 34 Hex Byte 4 12 Hex Byte 1 78 Hex High Low High REGISTER N (High) 14 Bit 24 Bit 15 Bit 8 Byte 2 56 Hex Low REGISTER N+1 (Low) HC900 Hybrid Controller Communications User Guide Revision 4 9/03
Modbus Double Register Format Unsigned/signed 32-bit Register Formats FP L – Little Endian Format The value 12345678 Hex will be represented as follows: Bit 7 Bit 0 Bit 15 Bit 23 Bit 16 Byte 1 78 Hex Byte 2 56 Hex Byte 3 34 Hex High Low High REGISTER N (High) Revision 4 9/03 Bit 8 Bit 31 Bit 24 Byte 4 12 Hex Low REGISTER N+1 (Low) HC900 Hybrid Controller Communications User Guide 15
Modbus Double Register Format Unsigned/signed 32-bit Register Formats FP LB – Little Endian Byte Swap Format The value 12345678 Hex will be represented as follows: Bit 15 Bit 8 Bit 7 Bit 0 Bit 24 Byte 2 56 Hex Byte 1 78 Hex Byte 4 12 Hex High Low High REGISTER N (High) 16 Bit 31 Bit 23 Bit 16 Byte 3 34 Hex Low REGISTER N+1 (Low) HC900 Hybrid Controller Communications User Guide Revision 4 9/03
Modbus/TCP & Modbus RTU Function Codes Definition 4. Modbus/TCP & Modbus RTU Function Codes 4.1 Definition The HC900 Modbus protocol uses a subset of the standard Modbus function codes to provide access to processrelated information. These standard function codes provide basic support for IEEE 32-bit floating point numbers, 32-bit unsigned/signed integer and 16-bit integer register representation of instrument’s process data.
Modbus/TCP & Modbus RTU Function Codes Definition Table 4-2 Maximum Number of Object Addresses Max. No.
Modbus/TCP & Modbus RTU Function Codes Definition Table 4-3 Maximum Number of Registers Allowable per Request Function Code Revision 4 9/03 Max. No.
Modbus/TCP & Modbus RTU Function Codes Function Code 01 – Read Digital Output Status 4.2 Function Code 01 – Read Digital Output Status Description Function code 01 (0X references) is used to read a digital output’s ON/OFF status of the HC900 using 16 bit addressing for DO access and data is returned in a binary format mapped into bytes. Broadcast is not supported. Query The query message specifies the starting Digital Output (DO) and the quantity of DOs to read.
Modbus/TCP & Modbus RTU Function Codes Function Code 01 – Read Digital Output Status Digital I/O Channel to Address Mapping The address mapping provides support for 5 racks of DI or DO modules. Each rack is allocated addressing for a maximum of 16 slots with 16 channels. The following table defines the rack, slot and channel address mapping used for DI and DO (each DI/O consumes 1 Modbus bit address): Table 4-5 shows the Modbus Comm Digital I/O Channel to Address Mapping for Rack #1.
Modbus/TCP & Modbus RTU Function Codes Function Code 01 – Read Digital Output Status Slot 5 CH# Slot 6 Address CH# Slot 7 Address CH# Slot 8 Address CH# Address Dec Hex Dec Hex Dec Hex 16 80 4F 16 96 5F 16 112 6F 16 Dec 128 Hex 7F 15 79 4E 15 95 5E 15 111 6E 15 127 7E 14 78 4D 14 94 5D 14 110 6D 14 126 7D 13 77 4C 13 93 5C 13 109 6C 13 125 7C 12 76 4B 12 92 5B 12 108 6B 12 124 7B 11 75 4A 11 91 5A 11 107 6A 11 123 7A 1
Modbus/TCP & Modbus RTU Function Codes Function Code 01 – Read Digital Output Status Slot 13 CH# Slot 14 Address Dec CH# Hex Slot 15 Address Dec CH# Hex Slot 16 Address Dec CH# Hex Address Dec Hex 16 208 CF 16 224 DF 16 240 EF 16 256 FF 15 207 CE 15 223 DE 15 239 EE 15 255 FE 14 206 CD 14 222 DD 14 238 ED 14 254 FD 13 205 CC 13 221 DC 13 237 EC 13 253 FC 12 204 CB 12 220 DB 12 236 EB 12 252 FB 11 203 CA 11 219 DA 11 235 EA
Modbus/TCP & Modbus RTU Function Codes Function Code 02 - Read Digital Input Status 4.3 Function Code 02 - Read Digital Input Status Description Function code 02 (1X references) is used to read a digital input’s ON/OFF status using 16 bit addressing for DI access and data is returned in a binary format mapped into bytes. Broadcast is not supported. Query The query message specifies the starting input and the quantity of inputs to read.
Modbus/TCP & Modbus RTU Function Codes Function Codes 03- Read Holding (Data) Registers 4.4 Function Codes 03- Read Holding (Data) Registers Description Function code 03 (also referred to as 4X decimal references) is used to read 32-bit floating point, 32-bit unsigned/signed integer and 16 bit integer data in the controller as described in Section 6. Registers are consecutive. It is also used to Read certain analog input modules for commonality of UMC800 controller addresses.
Modbus/TCP & Modbus RTU Function Codes Function Codes 03- Read Holding (Data) Registers master station requests only one register at an address of a floating point value then half of a float will be returned. The Modbus RTU protocol has a single byte count for function code 03, therefore the Modbus RTU protocol can only process up to 63 floating point and 127 16-bit integer values in a single request. Example: PV, Remote SP, Working SP, and Output where PV=100.0, RSP=100.0, WSP=100.0, and Out=55.
Modbus/TCP & Modbus RTU Function Codes Function Codes 04 - Read Input Registers 4.5 Function Codes 04 - Read Input Registers Description Function code 04(3X references) provides read access to Analog Input modules positioned in ANY Rack or Slot. All values are in IEEE 32-bit floating point format. Each Rack is allocated space for a maximum of 16 Slots and each Slot assumes Modules with a maximum of 8 Channels, which consumes 16 Modbus Register addresses.
Modbus/TCP & Modbus RTU Function Codes Function Codes 04 - Read Input Registers The Modbus RTU protocol has a single byte count for function code 04, therefore the Modbus RTU protocol can only process up to 63 floating point values in a single request. Example: Analog inputs #1 and #2 as floating point values where AI #1 = 100.0 and AI #2 =55.
Modbus/TCP & Modbus RTU Function Codes Function Code 05 - Force Single Digital Output 4.6 Function Code 05 - Force Single Digital Output Description Force a single digital output (0X reference) to either ON or OFF. These are the same digital outputs (DO) used in Function Code 01. The Modbus Comm Digital I/O Channel to address mapping is shown in Table 4-5. The HC900 does not support broadcast, and forcing can only be done in the Run mode. Query The query message specifies the DO to be forced.
Modbus/TCP & Modbus RTU Function Codes Function Code 06 - Preset Single Register 4.7 Function Code 06 - Preset Single Register Description Presets integer value into a single register (also refered to as 4X references). The HC900 does not support Broadcast. The registers that are specified in Section 6 with an access type “W” and integer and bit packed (16-bit register) data types, can be written to via Function Code 06.
Modbus/TCP & Modbus RTU Function Codes Function Code 08 - Loopback Message 4.8 Function Code 08 - Loopback Message Description Echoes received query message. Query Message can be any length up to half the length of the data buffer minus 8 bytes.
Modbus/TCP & Modbus RTU Function Codes Function Codes 16 (10h) - Preset Multiple Registers 4.9 Function Codes 16 (10h) - Preset Multiple Registers Description Presets values into a sequence of holding registers (also refered to as 4X references). The HC900 does not support Broadcast. The register assignments specified in Section 6 with an access type “W”, can be written to via Function Code 16 (10h). Writing to half of a digital variable will be accepted.
Modbus/TCP & Modbus RTU Function Codes Function Code 17 (11h) - Report HC900 ID 4.10 Function Code 17 (11h) - Report HC900 ID Description Function code 17 (11h) is used to report the device information such as Slave ID, device description and firmware version. Query The query message specifies the function code only. Example: Read Device ID from a slave at address 2.
Modbus/TCP & Modbus RTU Function Codes Function Code 17 (11h) - Report HC900 ID Number of Records - 1 Byte unsigned value 00-FFh (byte 23) Record Description: Byte Description 00 Type of Data Element (See Data Element Values Table Below) 01 Starting Address of Data Element Record (High) 02 Starting Address of Data Element Record (Low) 03 Number of Data Elements (High) 04 Number of Data Elements (Low) Data Element Values Table: 34 Value Description 00 Analog Inputs 01 Not Applicable.
Modbus RTU Exception Codes Introduction 5. Modbus RTU Exception Codes 5.1 Introduction When a master device sends a query to a slave device it expects a normal response. One of four possible events can occur from the master’s query: • Slave device receives the query without a communication error and can handle the query normally. It returns a normal response. • Slave does not receive the query due to a communication error. No response is returned.
Modbus RTU Exception Codes Introduction Table 5-1 Modbus RTU Data Layer Status Exception Codes Exception Code 36 Definition Description 01 Illegal Function The message received is not an allowable action for the addressed device. 02 Illegal Data Address The address referenced in the function-dependent data section of the message is not valid in the addressed device. 03 Illegal Data Value The value referenced at the addressed device location is not within range.
Register Map for Process and Operation Type Variables Register Map Overview 6. Register Map for Process and Operation Type Variables What’s in this section? This section describes all parameters accessible by Function Code 03, 04, 06 and 10h. Section 6.1 gives a global overview of each function and its addresses/registers. Sections 6.2 through 6.28 contain the details on each function and each of its parameters. Your particular controller may not contain all parameters shown.
Register Map for Process and Operation Type Variables Register Map Overview Start Address (hex) 7940 7A40 7B40 7C40 7D40 7E40 7F40 1800 18C0 1DF0 1E00 1E10 1E20 1E30 8000 8010 8020 8030 1F00 1F40 1F80 1FC0 8070 80B0 80F0 8130 2000 3B60 2800 2A00 2C00 2E00 8200 8400 8600 8800 3000 3050 3200 6C00 5AA0 38 End Address (hex) 79FF 7AFF 7BFF 7CFF 7DFF 7EFF 7FFF 187F 1D6F 1DF6 1E0F 1E1F 1E2F 1E3F 800F 801F 802F 803F 1F3F 1F7F 1FBF 1FFF 80AF 80EF 812F 816F 27CF 5A9F 29FF 2BFF 2DFF 2FFF 83FF 85FF 87FF 89FF 304F
Register Map for Process and Operation Type Variables Register Map Overview Start Address (hex) Revision 4 9/03 End Address (hex) 5AC0 5CBF 5CC0 5D00 5D20 5CFF 5D1F 5F1F 5F20 5F60 5F80 5F5F 5F7F 617F 6180 A000 A020 61BF A01F A21F A220 6600 6610 6620 6630 6640 6650 6660 6670 6680 6690 66A0 66B0 66C0 66D0 66E0 66F0 6B00 6B10 6B20 6B30 6B40 6B50 6B60 6B70 6B80 6B90 6BA0 6BB0 A25F 6606 6616 6626 6636 6646 6656 6666 6676 6686 6696 66A6 66B6 66C6 66D6 66E6 66F6 6B09 6B19 6B29 6B39 6B49 6B59 6B69 6B79
Register Map for Process and Operation Type Variables Register Map Overview Start Address (hex) 40 End Address (hex) Description 6BC0 6BD0 6BE0 6BF0 6700 6730 6760 6790 67C0 67F0 6820 6850 6880 68B0 68E0 6910 6940 6970 69A0 69D0 6A00 6200 6230 6260 6290 62C0 62F0 6320 6350 6400 6430 6460 6490 64C0 64F0 6520 6550 6BC9 6BD9 6BE9 6BF9 6725 6755 6785 67B5 67E5 6815 6845 6875 68A5 68D5 6905 6935 6965 6995 69C5 69F5 6A10 6227 6257 6287 62B7 62E7 6317 6347 6377 642D 645D 648D 64BD 64ED 651D 654D 657D Device
Register Map for Process and Operation Type Variables Miscellaneous Register Map 6.
Register Map for Process and Operation Type Variables Loop Value Register Map 6.3 Loop Value Register Map This table contains addresses of Loop #1. See the Global Register Map - Table 6-1 for starting and ending addresses (hex) for Loop #2 through Loop #32. Each successive control loop is offset by 256 with the exception that loop 25 has a new starting address and loop 26 - 32are offset by 256. The loop number corresponds to the PID block entry sequence during Hybrid Control Designer configuration.
Register Map for Process and Operation Type Variables Loop Value Register Map Address (hex) Register (decimal) Parameter Name Access Notes 0060 0097 Gain #2 (Prop Band #2 if active) R/W Floating Point 0062 0099 Three Position Step Motor Deadband R/W Floating Point in percent 0064 0101 Reset #2 R/W Floating Point in Repeats/Minute or Minutes/Repeat as configured in the HC900.
Register Map for Process and Operation Type Variables Loop Value Register Map Address (hex) Register (decimal) Parameter Name Access Notes 00F7 0248 Enable/Disable Fuzzy R/W Bit Packed Bit 0: 0:Disable; 1:Enable 00F8 0249 Demand Tune Request R/W Bit Packed (one shot action, activates autotuning until autotuning completed) Bit 0: 0:Off; 1:On Bit 1-15: Unused 00F9 0250 Anti-soot set point limit enable R/W Bit Packed Bit 0: 0:Off; 1:On Bit 1-15: Unused 00FA 0251 Auto/Manual State R/W B
Register Map for Process and Operation Type Variables Example for queries using Function Codes 3, 6, 16 6.4 Example for queries using Function Codes 3, 6, 16 Example 1 Query: Read PV, Remote SP, Working SP, Output for Loop 1 from HC900 at slave address 01 using Function Code 3 (hex codes). This will be accomplished by accessing contiguous registers. TCP: 00 03 00 40 00 08 01 03 00 40 00 08 RTU: CRC CRC Response: where PV=1000.0, Remote SP=1000.0, Working SP=1000.0, Output=50.
Register Map for Process and Operation Type Variables Example for queries using Function Codes 3, 6, 16 Response: from preset of LSP#1, address 006A to 100.0 at address 1.
Register Map for Process and Operation Type Variables Analog Input Value Register Map - Function Code 03 6.5 Analog Input Value Register Map - Function Code 03 Summary Used to access analog input parameters for the first eight slots of Rack #1.(Address compatible with UMC800) Analog Input Example: AI1 through AI64. The mapping is with respect to card position starting with the first card module position and continuing to the 8th module position.
Register Map for Process and Operation Type Variables Analog Input Value Register Map - Function Code 04 6.6 Analog Input Value Register Map - Function Code 04 Summary Used to access analog input parameters positioned in any Rack or Slot. Analog Input Example: AI1 through AI64. The mapping is with respect to card position starting with the first card slot position (numbered 1 through 16, starting at the lower left) with an analog input card.
Register Map for Process and Operation Type Variables Variable Register Map 6.7 Variable Register Map Summary Variables (analog or digital) are writeable parameters in HC900 attached to input pins of function blocks. Digital Variable status is also represented in floating point: 0.0 for OFF or logic 0 and 1.0 for ON or logic 1. The Variable number in the table corresponds to the Variable number in the HC900 configuration.
Register Map for Process and Operation Type Variables Time Register Map Example Query: Read Variables 1 and 2 from HC900 at address 1 using Function Code 3 (hex codes). TCP: 00 03 18 C0 00 04 03 18 C0 00 04 RTU: 01 CRC CRC Response: from HC900 where Variable 1 = 100.0 and Variable 2 = 55.32 TCP: 00 03 08 42 C8 00 00 42 5D 47 AE 03 08 42 C8 00 00 42 5D 47 AE RTU: 01 CRC CRC 6.
Register Map for Process and Operation Type Variables Signal Tag Register Map 6.9 Signal Tag Register Map Summary Signal tags are connected to output pins of function blocks, representing analog or digital parameters, and are read-only parameters. Digital Signal tags are also represented in floating point, 0.0 for OFF or logic 0, 1.0 for ON or logic 1. The signal tag number in the table corresponds to the signal tag number in the HC900 Hybrid Control Designer configuration.
Register Map for Process and Operation Type Variables Signal Tag Register Map 5A9F 23200 Tagged Signal #4000 Example Query: Read Signal Tags 3 and 4 from HC900 at address 1 using Function Code 3 (hex codes). TCP: 00 03 20 04 00 04 03 20 04 00 04 RTU: 01 CRC CRC Response: from HC900 where Signal Tag 3 = 100.0 and Signal Tag 4 = 55.
Register Map for Process and Operation Type Variables Set Point Program Register Maps 6.10 Set Point Program Register Maps Summary The SP Programmer parameters are listed according to category related to program status and interaction, other programmer parameters and program segment mapping. A section is also provided to aid in configuring a SP programmer and recipe interface for third party software.
Register Map for Process and Operation Type Variables Set Point Program Register Maps Controlling the Program For controlling the program, the following parameters should be accessed: Parameter Addr (Hex) Addr (Decimal) Notes SP Programmer Output 1E00 7681 See Table 6-13 Current Segment Number 1E02 7683 See Table 6-13 Program Elapsed Time 1E04 7685 See Table 6-13 Segment Time Remaining 1E08 7689 See Table 6-13 Current Segment Events 1E0A 7691 See Table 6-13 Status 1E0B 7692 See T
Register Map for Process and Operation Type Variables Set Point Program Register Maps Procedures for Downloading Setpoint Programs These steps are for programmer 1. For programmers 2, 3, 4, 5, 6, 7, and 8 adjust the register addresses accordingly by adding offset for starting addresses. Table 6-11 is for downloading using Function Codes 3, 4, 6, 16.
Register Map for Process and Operation Type Variables Set Point Programmer Value Register Map 6.11 Set Point Programmer Value Register Map This table contains Value Register addresses of SP Programmer #1. See the Global Register Map - Table 6-1 for starting and ending addresses (hex) for SP Programmer #2 through SP Programmer #8 Value Register Map Addresses.
Register Map for Process and Operation Type Variables Set Point Programmer Value Register Map Address (hex) Register (decimal) 1E0E 7695 Channel Number Advance Access W Notes Signed 16 bit integer Write to location Advances Profile one segment while in Hold mode; Data ignored 1E0F 7696 Reset W Signed 16 bit integer Write to location Resets Profile after program is first in Hold mode; Data ignored Revision 4 9/03 HC900 Hybrid Controller Communications User Guide 57
Register Map for Process and Operation Type Variables Set Point Programmer Additional Values Register Map 6.12 Set Point Programmer Additional Values Register Map This table contains Additional Value Register addresses of SP Programmer #1. See the Global Register Map - Table 6-1 for starting and ending addresses (hex) for SP Programmer #2 through SP Programmer #8 Additional Value Register Map Addresses.
Register Map for Process and Operation Type Variables Set Point Programmer Additional Values Register Map Address (hex) Register (decimal) 1F0E 7951 Display Low Range Limit R/W Floating Point Writing to this register is only permissible in the reset or ready mode 1F10 7953 Jog Segment R/W Floating Point Writing to this register is only permissible in the reset or ready mode 1F12 7955 Loop Start R/W Floating Point 0 indicates no loop.
Register Map for Process and Operation Type Variables Set Point Programmer Segment Map 6.13 Set Point Programmer Segment Map A profile contains up to 50 segments. Each segment is made up of 8 registers. This table contains Segment Map addresses of SP Programmer #1. See the Global Register Map - Table 6-1 for starting and ending addresses (hex) for SP Programmer #2 through SP Programmer #8 Segment Map Addresses.
Register Map for Process and Operation Type Variables Segment Register Map 6.14 Segment Register Map The table below describes the registers that are part of a setpoint programmer segment. To determine the actual register address for a parameter within a segment, add the register offset to the start address of the segment.
Register Map for Process and Operation Type Variables Segment Register Map Example For Determining a Segment Register To change the ramp value in segment #8 of setpoint programmer #2, the register address is determined as follows. Step 1: Use Table 6-1 to determine the start address for setpoint program #2 profile. The value is 2A00 Hex. Step 2: Calculate the offset address for segment 8 in a profile.
Register Map for Process and Operation Type Variables Scheduler Value Register Map 6.15 Scheduler Value Register Map Summary The SP Scheduler parameters are listed according to category related to SP Scheduler status plus interaction and scheduler segment mapping. A section is also provided to aid in configuring a Scheduler and recipe interface for third party software.
Register Map for Process and Operation Type Variables Scheduler Value Register Map Scheduler Numbers The parameters that follow refer to SP Scheduler #1. Table 6-10 lists the Starting and Ending addresses for all of the SP Schedulers.
Register Map for Process and Operation Type Variables Scheduler Value Register Map Procedure for Uploading Setpoint Schedules Table 6-19 Steps to Upload a Setpoint Schedule using Modbus Function Codes 3, 6, 16 Step Action 1 Set the scheduler to RESET by writing any number to 12367 (304E). This can be done either with function code 6 or 16. 2 Load the schedule into the setpoint scheduler block by writing the schedule number to registers 12321 and 12322 (3020 and 3021).
Register Map for Process and Operation Type Variables Scheduler Value Register Map Address (hex) Register (decimal) 3020 12321 Current Program Number R/W 3022 12323 Current Segment Number R/W 3024 12325 Program Elapsed Time R 3026 3028 12327 12329 Segment Time Remaining Schedule Save Request R R/W 302A 302C 302E 3030 3032 3034 3036 3038 303A 12331 12333 12335 12337 12339 12341 12343 12345 12347 Guaranteed Soak Limit 1 Guaranteed Soak Limit 2 Guaranteed Soak Limit 3 Guaranteed Soak Limit
Register Map for Process and Operation Type Variables Scheduler Value Register Map Address (hex) Register (decimal) Channel Number Access 3049 12362 Current Segment Events (Bit Packed) R 304A 12363 Status (Bit Packed) R 304B 12364 Start W 304C 12365 Hold W 304D 12366 Advance W 304E 12367 Reset W 304F 12368 Time Units R/W Notes Bit Packed Indicates status of events Bit 0: Event #1 : : Bit 15: Event #15 0: Event OFF 1: Event ON Bit Packed Bit 0: 1=Ready 1: 1=Run 2: 1=Hold 3: 1
Register Map for Process and Operation Type Variables Scheduler Segment Register Map 6.16 Scheduler Segment Register Map A schedule can contain up to 50 segments. Each segment is made up of 48 (30 hex) registers. This table contains Segment Map addresses of SP Scheduler #1. See the Global Register Map - Table 6-1 for starting and ending addresses (hex) for SP Scheduler #2 Addresses.
Register Map for Process and Operation Type Variables Segment Register Map 6.17 Segment Register Map The table below describes the registers that are part of a schedule segment. To determine the actual register address for a parameter within a segment, add the register offset to the start address of the segment.
Register Map for Process and Operation Type Variables Segment Register Map Register Offset within segment (Hex) Register Offset within segment (Decimal) 001A 0026 001C 0028 001E 0030 0020 0032 0022 0034 0024 0036 0026 0038 0028 0040 002A 0042 002C 002E Parameter Name Access 0044 Output #8 Ramp or Soak value Soak value for Auxiliary Output #1 Soak value for Auxiliary Output #2 Soak value for Auxiliary Output #3 Soak value for Auxiliary Output #4 Soak value for Auxiliary Output #5 Soa
Register Map for Process and Operation Type Variables Sequencer Register Maps 6.18 Sequencer Register Maps Summary The Sequencer Register Maps are listed according to category related to Sequencer operation.
Register Map for Process and Operation Type Variables Sequencer #1 Parameters Register Map 6.19 Sequencer #1 Parameters Register Map Summary This table contains Parameter Map addresses of Sequencer #1. See the Sequencer Parameter Register Maps - Table 6-23 for starting and ending addresses (hex) for Sequencer #2 through Sequencer #4 Parameter Map Addresses.
Register Map for Process and Operation Type Variables Sequencer #1 Step 1 Table Register Map Address (hex) Register (decimal) 5AB2 23219 Channel Number Sequence status Access R Notes Integer value for bit packed current sequence state : Bit 0 = Ready Bit 1 = Run Bit 2 =Hold Bit 3 = Stop Bit 4 = Disable Bit 5 = time units (minutes) Bit 6 = time units (hours) 5AB4 23221 State R Integer value for current state number 5AB6 23223 Auxiliary Output R Floating point value auxiliary output 6.
Register Map for Process and Operation Type Variables Sequencer #1 State Table Register Map 6.21 Sequencer #1 State Table Register Map Summary This table contains State Table Map addresses of Sequencer #1. See the Sequencer State Table Register Maps - Table 6-25 for starting and ending addresses (hex) for Sequencer #2 through Sequencer #4 State Table Map Addresses.
Register Map for Process and Operation Type Variables Hand/OFF/Auto Control Group Register Map 6.22 Hand/OFF/Auto Control Group Register Map Summary This table contains Hand/Off/Auto Map addresses of HOA Group #1. See the HOA Register Maps Table 6-1 for starting and ending addresses (hex) for Hand/Off/Auto Group #2 through Hand/Off/Auto Group #16 Map Addresses. The Modbus HOA number address for a HOA can also be obtained from the Hybrid Control Designer printout of "Block Modbus Addresses".
Register Map for Process and Operation Type Variables Device Control Group Register Map 6.23 Device Control Group Register Map Summary This table contains addresses for the Device Control group #1. See the Device Control Register Maps in Table 6-1 for starting and ending addresses (hex) for Device Control Group #2 through Device Control Group #16 Map Addresses.
Register Map for Process and Operation Type Variables Alternator Group Register Map 6.24 Alternator Group Register Map Summary This section contains addresses for the Alternator #1group. See the Alternator Register Maps in Table 6-1 for starting and ending addresses (hex) for Alternator #2 through Alternator #16 Map Addresses. The Modbus Alternator number address for an Alternator can also be obtained from the Hybrid Control Designer printout of "Block Modbus Addresses".
Register Map for Process and Operation Type Variables Alternator Group Register Map Address (hex) Register (decimal) Parameter Name Access Notes Bit 1: Input #1 ON: 0=OFF, 1=ON Bit 2: Input #2 Enable: 0=NO, 1=YES Bit 3: Input #2 ON: 0=OFF, 1=ON Bit 4: Input #3 Enable: 0=NO, 1=YES Bit 5: Input #3 ON: 0=OFF, 1=ON Bit 6: Input #4 Enable: 0=NO, 1=YES Bit 7: Input #4 ON: 0=OFF, 1=ON Bit 8: Input #5 Enable: 0=NO, 1=YES Bit 9: Input #5 ON: 0=OFF, 1=ON Bit 10: Input #6 Enable: 0=NO, 1=YES Bit 11: Input #6 ON:
Register Map for Process and Operation Type Variables Alternator Group Register Map Address (hex) Register (decimal) Parameter Name Access Notes Bit 9: Output #3 Used: 0=NO, 1=YES Bit 10: Output #3 ON: 0=OFF, 1=ON Bit 11: Unused Bit 12: Output #4 Enable: 0=NO, 1=YES Bit 13: Output #4 Used: 0=NO, 1=YES Bit 14: Output #4 ON: 0=OFF, 1=ON Bit 15: Unused 6705 26374 Output Status #5-8 R Bit Packed: Bit 0: Output #5 Enable: 0=NO, 1=YES Bit 1: Output #5 Used: 0=NO, 1=YES Bit 2: Output #5 ON: 0=OFF, 1=ON B
Register Map for Process and Operation Type Variables Alternator Group Register Map Address (hex) Register (decimal) Parameter Name Access 16 Notes Bit 0: Output #13 Enable: 0=NO, 1=YES Bit 1: Output #13 Used: 0=NO, 1=YES Bit 2: Output #13 ON: 0=OFF, 1=ON Bit 3: Unused Bit 4: Output # Enable: 0=NO, 1=YES Bit 5: Output #14 Used: 0=NO, 1=YES Bit 6: Output #14 ON: 0=OFF, 1=ON Bit 7: Unused Bit 8: Output #15 Enable: 0=NO, 1=YES Bit 9: Output #15 Used: 0=NO, 1=YES Bit 10: Output #15 ON: 0=OFF, 1=ON Bit 11:
Register Map for Process and Operation Type Variables Alternator Group Register Map Address (hex) Register (decimal) Parameter Name Access Notes Bit 3: Device #4 Enable: 0=NO, 1=YES Bit 4: Device #5 Enable: 0=NO, 1=YES Bit 5: Device #6 Enable: 0=NO, 1=YES Bit 6: Device #7 Enable: 0=NO, 1=YES Bit 7: Device #8 Enable: 0=NO, 1=YES Bit 8: Device #9 Enable: 0=NO, 1=YES Bit 9: Device #10 Enable: 0=NO, 1=YES Bit 10: Device #11 Enable: 0=NO, 1=YES Bit 11: Device #12 Enable: 0=NO, 1=YES Bit 12: Device #13 Enabl
Register Map for Process and Operation Type Variables Alternator Group Register Map Address (hex) Register (decimal) Parameter Name 671B 26396 Output Order Sequence #6 R Unsigned 16 integer 671C 26397 Output Order Sequence #7 R Unsigned 16 integer 671D 26398 Output Order Sequence #8 R Unsigned 16 integer 671E 26399 Output Order Sequence #9 R Unsigned 16 integer 671F 26400 Output Order Sequence #10 R Unsigned 16 integer 6720 26401 Output Order Sequence #11 R Unsigned 16 integ
Register Map for Process and Operation Type Variables Output Order Sequence Scratch Pad Register Map 6.25 Output Order Sequence Scratch Pad Register Map Summary Output Order Sequence Scratch Pad registers in the Alternator Parameters are modified by using the output order sequence scratchpad and the sequence write request. This section contains addresses for the Output order Sequence Scrarch pad.
Register Map for Process and Operation Type Variables Output Order Sequence Scratch Pad Register Map Address (hex) Register (decimal) Parameter Name Access Notes (See attention below) 6A0A 27147 Output Order Sequence #11 R/W Unsigned 16 integer Only for Fixed and Direct styles. (See attention below) 6A0B 27148 Output Order Sequence #12 R/W Unsigned 16 integer Only for Fixed and Direct styles.
Register Map for Process and Operation Type Variables Stage Group Register Map 6.26 Stage Group Register Map Summary This section contains addresses for the Stage #1 Group. See the Stage Group Register Maps in Table 6-1 for starting and ending addresses (hex) for Stage Group #2 through Stage Group #8 Map Addresses. The Modbus Stage number address for a Stage Group can also be obtained from the Hybrid Control Designer printout of "Block Modbus Addresses".
Register Map for Process and Operation Type Variables Stage Group Register Map Address (hex) Register (decimal) Parameter Name Access Notes 0=NO, 1=YES Bit 2: Stage #1 Error with Interlocks 0=NO, 1=YES Bit 3: Stage #2 Interlock with Previous Stage 0=NO, 1=YES Bit 4: Stage #2 Interlock with Next Stage 0=NO, 1=YES Bit 5: Stage #2 Error with Interlocks 0=NO, 1=YES Bit 6: Stage #3 Interlock with Previous Stage 0=NO, 1=YES Bit 7: Stage #3 Interlock with Next Stage 0=NO, 1=YES Bit 8: Stage #3 Error with Inte
Register Map for Process and Operation Type Variables Stage Group Register Map Address (hex) Register (decimal) Parameter Name Access Notes Setpoint 6214 25109 Stage #3 OFF Setpoint R/W Floating Point in Engineering Units 6216 25111 Stage #4 OFF Setpoint R/W Floating Point in Engineering Units 6218 25113 Stage #1 Latch Delay R/W Floating Point in Seconds 621A 25115 Stage #2 Latch Delay R/W Floating Point in Seconds 621C 25117 Stage #3 Latch Delay R/W Floating Point in Seconds
Register Map for Process and Operation Type Variables Ramp Group Register Map 6.27 Ramp Group Register Map Summary This section contains addresses for the Ramp #1 Group. See the Ramp Group Register Maps in Table 6-1 for starting and ending addresses (hex) for Ramp Group #2 through Ramp Group #8 Map Addresses. The Modbus Ramp number address for a Ramp Group can also be obtained from the Hybrid Control Designer printout of "Block Modbus Addresses".
Register Map for Process and Operation Type Variables Ramp Group Register Map Address (hex) Register (decimal) Parameter Name Access Notes 0=Low Limit, 1= High Limit Bit 8-15: Unused 640E 25615 Ramp #1 Output Scale High R/W Floating Point in Engineering Units 6410 25617 Ramp #2 Output Scale High R/W Floating Point in Engineering Units 6412 25619 Ramp #3 Output Scale High R/W Floating Point in Engineering Units 6414 25621 Ramp #4 Output Scale High R/W Floating Point in Engineering Un
Register Map for Process and Operation Type Variables User Defined Registers 6.28 User Defined Registers Each register can be assigned to a signal tag or variable defined in a function block diagram. The data type is configurable to be floating-point, signed-16, unsigned-16, signed-32, or unsigned-32. Floating point, signed-32, and unsigned-32 must start on an even hex address. 32-bit data uses the same byte-order format as defined for the port’s double-register format.
Index Index A E Advance, 57, 67, 72 Advance (write only), 54 Advance Next step, 73 Advance Request, 80 Alarm #1 SP #1, 42 Alarm #1 SP #2, 42 Alarm #2 SP #1, 43 Alarm #2 SP #2, 43 Alternator #1Group Register Map, 77 Alternator Status, 77 analog input, 47, 48 Analog Input Value Register Map Addresses Function Code 03, 47 Analog Input Value Register Map Addresses for Rack #1 - Function Code 04, 48 Anti-soot set point limit enable, 44 Auto/Manual State, 44 Auxiliary Output, 54, 58, 73 B Bias, 43 Block Modbus
Index H N HC900 AI Address Mapping supported by Function Code 03, 25 HC900 AI Address Mapping supported by Function Code 04, 27, 48 HOA Control #1 Group Register Map, 75 Hold, 56, 67, 72 Hold (write only), 54 I IEEE 32-bit Floating Point Register, 7 Illegal Data Address, 36 Illegal Data Value, 36 Illegal Function, 36 Input Count, 80 Input Limit High, 89 Input Limit Low, 89 Input Status, 77 Interface Preparation, 1 J Jog Segment, 59, 66 Jog to step number, 72 Negative Acknowledge, 36 Number of Registers
Index Ramp/Soak Segment, 61 Rate #1, 42 Rate #2, 43 Read Coil Status, 17, 20 Read Holding Registers, 17 Read Input Registers, 17, 25 Read Input Status, 17, 24 Register Map for Process and, 37 Remaining Delay Time, 76 Remote Auto-state Change Request, 75 Remote Hand-state Change Request, 75 Remote Off-state Change Request, 75 Remote Set Point; SP2, 42 Remote Source, 75 Remote/Local Set Point State, 44 Repeats, 59 Report Device ID, 17, 33 Reserved Operands, 9 Reset, 57, 67, 72 Reset #1, 42 Reset #2, 43 Reset
Index 94 HC900 Hybrid Controller Communications User Guide Revision 4 9/03
Sales and Service Sales and Service For application assistance, current specifications, pricing, or name of the nearest Authorized Distributor,contact one of the offices below. ARGENTINA Honeywell S.A.I.C. Belgrano 1156 Buenos Aires Argentina Tel. : 54 1 383 9290 ASIA PACIFIC Honeywell Asia Pacific Inc. Room 3213-3225 Sun Kung Kai Centre N° 30 Harbour Road Wanchai Hong Kong Tel. : 852 829 82 98 CANADA Honeywell Limited The Honeywell Centre 300 Yorkland Blvd. Toronto, Ontario M2j 1s1 Canada Tel.
96 HC900 Hybrid Controller Communications User Guide Revision 4 9/03
Industrial Measurement and Control Honeywell 1100 Virginia Drive Fort Washington, PA 19034 51-52-25-111 Rev. 4 0903 Printed in USA www.honeywell.
