background image

COMMERCIAL IN CONFIDENCE

Page 2

1.  MEMORY MAP OF PARAMETERS

WARNING:-

 As with any computer system writing to any unauthorised memory address will

inevitably cause malfunction and may put the instrument in an indeterminate or dangerous state. It is
the users responsibility to ensure correct use.

The instruments uses a 8051 type processor. This has two types of  RAM: the internal 256 bytes and
the  external  256 bytes, data is also stored in EEPROM (non-volatile ram).  Each data area requires a
different access method internally.

Data can be accessed as either one byte or a two byte word - the word need not necessarily lie on an
even address boundary. To simplify ModBus messages the unit decodes the MSB of the ModBus
address to select which type of memory to access - thus all memory looks the same to the end user.
Decoding is as follows:

bit 7

bit 6

bit 5

bit 4

bit 3

bit 2

bit 1

bit 0

always 0

always 0

always 0

1=security

always 0

1=NVram

1=external

1=one byte

so that the following addresses specify the given memory areas:

 

00xxH references internal memory  - two bytes wide

 

01xxH references internal memory  -  one byte wide

 

02xxH references external memory  - two bytes wide

 

03xxH references external memory  - one byte wide

 

04xxH references NV memory  - two bytes wide

 

05xxH references NV memory  - one byte wide

note that messages with both bits 1 and 2 set are misleading and should not occur, however, they will
be interpreted as if bit  2 was 0. Bit 4 is used to indicate reserved messages - see the section 

Security

Messages

 below.

Two types of bit value may exist:

 

those which can be set and cleared as a single operation (i.e. directly addressable) are
defined as type 

bit

.

 

 those which must be set or cleared by reading a byte, masking the bit, then writing the
byte.

Bit addresses are represented by both the absolute hex address and also by bit number (in decimal) if
the bit is directly addressable. Note that, in this document, the bit number is one based (1..128) which
matches the usual representation of ModBus.

The byte and word addresses given are the absolute HEX locations in the instrument.
Depending on the type of ModBus driver being used, these may need to be converted to a
decimal address, plus 1, since some ModBus drivers subtract 1 from the address given. 

Thus to

access the Baud Rate (03D6) a ModBus driver would need decimal address 983 (982 + 1).

Shaded sections denote contiguous address space which may be read and written as multiple
registers if the remote software can handle this.  

NOTE that due to space limitations the current

implementation does not allow multiple address access - only one word can be accessed per
message.

To facilitate easy reading, the following tables are listed in address order, not the order on the menus.

Extreme care must be taken to write only to those locations indicated. Writing to any other
locations WILL corrupt the instrument, but the effects may not necessarily be immediately
noticed.

Summary of Contents for 3300P

Page 1: ...COMMERCIAL IN CONFIDENCE CAL 3300 9300 9400 9500 P MODBUS RTU COMMUNICATIONS GUIDE 7th September 2000 ISSUE 1 10 Doc 33034 Iss 002...

Page 2: ...lers would perform before transmitting the new data out over the bus to the instrument The CAL controllers assume that the values they receive have been checked against limits and are valid no further...

Page 3: ...ing and should not occur however they will be interpreted as if bit 2 was 0 Bit 4 is used to indicate reserved messages see the section Security Messages below Two types of bit value may exist those w...

Page 4: ...s linear Also note that while linear input is selected the display of values on the instrument is effected by the setting in DECP not Disp The instrument provides no error checking on values transmitt...

Page 5: ...wer priority than the displays recorded by the Display Byte If no bit is set the instrument is not in a ramp soak sequence If the unit has finished a ramp but no soak time is specified SOAK bit 2 will...

Page 6: ...ending on disp selection min LoSc max HiSc Ofst 2 0083 RW 3 6 Degrees 10 LIN normal inc dec see separate details for limits Band 2 0085 RW 3 6 Degrees 10 LIN normal inc dec min 0 1 max 25 of Sensor Ma...

Page 7: ...1 0190 RW 3 6 No scaling step by 1 min 0 max 100 PL 2 1 0191 RW 3 6 No scaling step by 1 min 0 max 100 SP2 A 1 0192 RW 3 6 0 none 1 dvhi 2 dvlo 3 band 4 fshi 5 fslo 6 cool 9500P 7 EOP SP2 b 1 0193 RW...

Page 8: ...with degC to decF if required if unit 1 Read hi 2 007A R 3 Read hi 10 LIN Read lo 2 007C R 3 Read lo 10 LIN Data Ct A 2 0432 R 3 CtA 25 Data Ct B 2 0434 R 3 CtB 25 Data Ct 1 2 0436 R 3 Ct1 25 Data Ct...

Page 9: ...sc Rev 3 1 03E5 RW 3 6 0 3d 1 3r Set 3 2 02E8 RW 3 6 Degrees 10 LIN step 0 1 min 0 0 max 2500 When LIN sensor selected max 9999 Hys 3 2 02EA RW 3 6 Hys3 10 LIN step 0 1 min 0 1 max 100 of HiSc Note Th...

Page 10: ...ing the enter program mode message causes the push buttons on the instrument to be locked out This feature prevents potentially dangerous conditions arising from simultaneous adjustment of the instrum...

Page 11: ...n 5 15 4 not used any value may be sent xx 5 not used any value may be sent xx 6 not used any value may be sent xx 7 CRC lo byte 8 CRC hi byte The security byte must be set to 5 prior to this message...

Page 12: ...is not a valid readable bit an error response code 2 invalid address is returned otherwise the following response is sent Byte No Meaning Value hex 1 Slave address xx 2 ModBus Function code read coil...

Page 13: ...Starting Address MSB xx 4 Starting Address LSB xx 5 Data MSB xx 6 Data LSB xx 7 CRC lo byte 8 CRC hi byte The normal response is the same as the message An error response code 2 illegal address will b...

Page 14: ...ceives full message correctly but cannot act on it An error response as detailed under each message heading is returned as follows Byte No Meaning Value 1 Slave address xx 2 Original ModBus Function c...

Page 15: ...erformed 7 Repeat from step 2 for the next byte of the message until all bytes have been processed 8 The final contents of the CRC register is the CRC value to use 9 When the CRC is placed in the mess...

Page 16: ...to read the setpoint the various sections of this code would normally be held in separate functions and would be optimised for better speed but this example shows the thought process involved note als...

Page 17: ...he reply if the Function code is 03 and the CRC is correct The CALController stores the Setpoint internally in 10th degree units so the value can be computed as setpoint reply 3 8 reply 4 10 or in a l...

Page 18: ...rrectly the whole sequence must be re started from message 1 1st Message byte 0 Slave address xx byte 1 Function code write register 06 hex always byte 2 Register Address high byte 03 hex always byte...

Page 19: ...ce for the values to take effect 1st Message byte 0 Slave address xx byte 1 Function code write register 06 hex always byte 2 Register Address high byte 03 hex always byte 3 Register Address low byte...

Page 20: ...D 2 Detailed later dependant on other functions CYC 2 ON OF 0 1 9 9 10 81 Seconds LEVEL 2 Function Values Limits SP1 P 0 100 Read only HAND OFF 1 100 PL1 100 0 PL2 100 0 SP2 A NONE DV HI DV LO BAND FS...

Page 21: ...LOSC SP LK So set point 1 is adjustable between the current high and low scale settings as long as the setpoint lock is off OFST INPT LIN CYC T ON OF 0 0 to 25 of sensor full scale DECP 0 1 to 81 0 0...

Page 22: ...DISP 1 0 to 250 0 1 0 to 199 9 If you change SP3 A at any time then the value of SET 3 defaults to zero There are a number of functions which when changed can have an effect on the values of other fun...

Page 23: ...ting C to F Here is a list of the functions that are effected by a C to F conversion and if a relative or absolute conversion is needed FUNCTION CONVERSION NOTES Set point 1 Absolute HISC Absolute LOS...

Page 24: ...99 9 400 0 LIN1 0 400 0 0 400 0 LIN2 25 400 25 0 400 0 LIN3 0 3000 0 0 999 9 LIN4 250 3000 199 9 999 9 LIN5 0 3000 0 0 999 9 LIN 9500 0 9999 N A N A TABLE 2 MIN MAX SENSOR FULL SCALE DEGREE F SENSOR M...

Page 25: ...0 0 400 0 LIN1 0 400 0 0 400 0 LIN2 0 400 0 0 400 0 LIN3 0 3000 0 0 999 9 LIN4 0 3000 0 0 999 9 LIN5 0 3000 0 0 999 9 LIN 9500 0 9999 N A N A TABLE 4 HI SC LO SC DEFAULT SETTINGS DEGREE F SENSOR DEFA...

Reviews: