Modbus Protocol Parameters

June 2004

FDC Series 100 Temperature & Process Controls

9100/8100/4100

Future Design Controls, Inc.

P.O. Box 1196 – Bridgeview – IL – 60455
888.751.5444 – Office 888.307.8014 – Fax
866.342.5332 – Technical Support
http://www.futuredesigncontrols.com
Chapter 7 Modbus Communications
This chapter specifies the Modbus Communications protocol as
RS-232 or RS-485 interface module is installed. Only RTU mode is
supported. Data is transmitted as eight-bit binary bytes with 1 start bit,
1 stop bit and optional parity checking (None, Even or Odd). Baud
rate may be set to 2400, 4800, 9600, 14400, 19200, 28800 and 38400.

7-1 Functions Supported

Only function 03, 06 and 16 are available for this series of controllers.
The message formats for each function are described as follows:

Function 03: Read Holding Registers

Query ( from master ) Response ( from slave )
Slave address (0-255)
Function code (3)
Starting address of register Hi (0) Byte count
Starting address of register Lo (0-79, Data 1 Hi
128-131) Data 1 Lo
No. of words Hi (0) Data 2 Hi
No. of words Lo (1-79) Data 2 Lo
CRC16 Hi
CRC16 Lo

CRC16 Hi
CRC16 Lo

Function 06: Preset single Register

Query ( from master ) Response ( from slave )
Slave address (0-255)
Function code (6)
Register address Hi (0)
Register address Lo (0-79, 128-131)
Data Hi
Data Lo
CRC16 Hi
CRC16 Lo

UM91001B 66
Function 16: Preset Multiple Registers
Query ( from master ) Response ( from slave )
Slave address (0-255)
Function code (16)
Starting address of register Hi (0)
Starting address of register Lo (0-79,
128-131)
No. of words Hi (0)
No. of words Lo (1-79)
Byte count (2-158) CRC16 Hi
Data 1 Hi CRC16 Lo
Data 1 Lo
Data 2 Hi
Data 2 Lo

CRC16 Hi
CRC16 Lo

67 UM91001B
7-2 Exception Responses
If the controller receives a message which contains a corrupted
character (parity check error, framing error etc.), or if the CRC16 check
fails, the controller ignores the message.
However, if the controller receives a syntactically correct message
which contains an illegal value, it will send an exception response,
consisting of five bytes as follows:
slave address +offset function code + exception code + CRC16 Hi +
CRC16 Lo
Where the offset function code is obtained by adding the function
code with 128 (ie. function 3 becomes H'83), and the exception code
is equal to the value contained in the following table:

Exception Code Name Cause

Function code is not supported
1 Bad function code by the controller
2 Illegal data address Register address out of range
Data value out of range or
3 Illegal data value attempt to write a read-only or
protected data

UM91001A 68
7-3 Parameter Table
Register Parameter Scale Scale
Parameter Notes
Address Notation Low High
0 SP1 Set point 1 *4 *4 R/W
1 SP2 Set point 2 *7 *7 R/W
2 SP3 Set point 3 *6 *6 R/W
3 LOCK Lock code 0 65535 R/W
4 INPT Input sensor selection 0 65535 R/W
5 UNIT Measuring unit 0 65535 R/W
6 DP Decimal point position 0 65535 R/W
7 INLO Low scale value for linear input *4 *4 R/W
8 INHI High scale value for linear input *4 *4 R/W
9 SP1L Low limit of SP1 *4 *4 R/W
10 SP1H High limit of SP1 *4 *4 R/W
11 SHIF PV shift value *4 *4 R/W
12 FILT Filter time constant 0 65535 R/W
13 DISP Display form ( for C21 ) 0 65535 R/W
14 PB P ( proportional ) band *5 *5 R/W
15 TI Integral time 0 65535 R/W
16 TD Derivative time 0.0 6553.5 R/W
17 OUT1 Output 1 function 0 65535 R/W
18 O1TY Output 1 signal type 0 65535 R/W
19 O1FT Output 1 failure transfer -1999.9 4553.6 R/W
20 O1HY Output 1 ON-OFF hysteresis *5 *5 R/W
21 CYC1 Output 1 cycle time 0.0 6553.5 R/W
22 OFST Offset value for P control 0.0 6553.5 R/W
23 RAMP Ramp function 0 65535 R/W
24 RR Ramp rate *5 *5 R/W
25 OUT2 Output 2 function 0 65535 R/W
26 RELO Retransmission low scale value *4 *4 R/W
27 O2TY Output 2 signal type 0 65535 R/W
28 O2FT Output 2 failure transfer -1999.9 4553.6 R/W
29 O2HY Output 2 ON-OFF hysteresis *5 *5 R/W

69 UM91001D
Register Parameter Scale Scale
Parameter Notes
Address Notation Low High
30 CYC2 Output 2 cycle time 0.0 6553.5 R/W
31 CPB Cooling P band 0 65535 R/W
32 DB Heating-cooling dead band -1999.9 4553.6 R/W
33 ALFN Alarm function 0 65535 R/W
34 REHI Retransmission high scale value *4 *4 R/W
35 ALMD Alarm opertion mode 0 65535 R/W
36 ALHY Alarm hysteresis *5 *5 R/W
37 ALFT Alarm failure transfer 0 65535 R/W
38 COMM Communication function 0 65535 R/W
39 ADDR Address 0 65535 R/W
40 BAUD Baud rate 0 65535 R/W
41 DATA Data bit count 0 65535 R/W
42 PARI Parity bit 0 65535 R/W
43 STOP Stop bit count 0 65535 R/W
44 SEL1 Selection 1 0 65535 R/W
45 SEL2 Selection 2 0 65535 R/W
46 SEL3 Selection 3 0 65535 R/W
47 SEL4 Selection 4 0 65535 R/W
48 SEL5 Selection 5 0 65535 R/W
49 SEL6 Selection 6 0 65535 R/W
50 SEL7 Selection 7 0 65535 R/W
51 SEL8 Selection 8 0 65535 R/W
52 ADLO mV calibration low coefficient -1999.9 4553.6 R/W
53 ADHI mV calibration high coefficient -1999.9 4553.6 R/W
54 RTDL RTD calibration low coefficient -1999.9 4553.6 R/W
55 RTDH RTD calibration high coefficient -1999.9 4553.6 R/W
56 CJLO Cold junction calibration low coefficient -199.99 455.36 R/W
57 CJHI Cold junction calibration high coefficient -1999.9 4553.6 R/W
58 DATE Date Code 0 65535 R/W
59 SRNO Serial Number 0 65535 R/W
60 HOUR Working hours of the controller 0 65535 R/W

UM91001D 70
Register Parameter Scale Scale
Parameter Notes
Address Notation Low High
61 BPL1 Bumpless transfer of OP1 0.00 655.35 R
62 BPL2 Bumpless transfer of OP2 0.00 655.35 R
63 CJCL Cold junction signal low 0.000 65.535 R
64, 128 PV Process value *4 *4 R
65, 129 SV Current set point value *4 *4 R
Read only,
66 OP1 control output value unless in
MV1 0.00 655.35
130 manual
control
Read only,
67 OP2 control output value unless in
MV2 0.00 655.35
131 manual
control
68 TIMER Remaining time of dwell timer -1999.9 4553.6 R
69 EROR Error code *1 0 65535 R
70 MODE Operation mode & alarm status *2 0 65535 R
71, 140 PROG Program code *3 0.00 655.35 R
72 CMND Command code 0 65535 R/W
73 JOB1 Job code 0 65535 R/W
74 JOB2 Job code 0 65535 R/W
75 JOB3 Job code 0 65535 R/W
76 CJCT Cold Junction Temperature -199.99 455.36 R
77 Reserved 0 65535 R
78 Reserved 0 65535 R
79 Reserved 0 65535 R

*1: The error code is show in the first column of Table A.1.
*2: Definition for the value of MODE register
H'000X = Normal mode H'0X00 = Alarm status is off
H'010X = Calibration mode H'0x01 = Alarm status is on
H'020X = Auto-tuning mode
H'030X = Manual control mode The alarm status is shown in
H'040X = Failure mode MV2 instead of MODE for
models C21 and C91.

71 UM91001D
*3: The PROG Code is defined in the following table:
Model No. BTC-9100 BTC-8100 BTC-4100 BTC-7100 C21 C91
PROG Code 6.XX 11.XX 12.XX 13.XX 33.XX 34.XX
Where XX denotes the software version number. For example:
PROG=34.18 means that the controller is C91 with software version
18.
*4: The scale high/low values are defined in the following table for SP1,
INLO, INHI, SP1L, SP1H, SHIF, PV, SV, RELO and REHI:
Non-linear Linear input Linear input Linear input Linear input
Conditions input DP = 0 DP = 1 DP = 2 DP = 3
Scale low -1999.9 -19999 -1999.9 -199.99 -19.999
Scale high 4553.6 45536 4553.6 455.36 45.536
*5: The scale high/low values are defined in the following table for PB,
O1HY, RR, O2HY and ALHY:
Non-linear Linear input Linear input Linear input Linear input
Conditions input DP = 0 DP = 1 DP = 2 DP = 3
Scale low 0.0 0 0.0 0.00 0.000
Scale high 6553.5 65535 6553.5 655.35 65.535

*6: The scale high/low values are defined in the following table for SP3:
ALFN=1 Non-linear Linear input Linear input Linear input Linear input
Conditions (TIMR) input DP = 0 DP = 1 DP = 2 DP = 3
Scale low -1999.9 -1999.9 -19999 -1999.9 -199.99 -19.999
Scale high 4553.6 4553.6 45536 4553.6 455.36 45.536

*7: The scale high/low values are defined in the following table for SP2:
For C21 and C91.
OUT2=1 Non-linear Linear input Linear input Linear input Linear input
Conditions (TIMR) input DP = 0 DP = 1 DP = 2 DP = 3
Scale low -1999.9 -1999.9 -19999 -1999.9 -199.99 -19.999
Scale high 4553.6 4553.6 45536 4553.6 455.36 45.536

UM91001D 72
 For BTC-9100, BTC-8100, BTC-7100 and BTC-4100
Non-linear Linear input Linear input Linear input Linear input
Conditions input DP = 0 DP = 1 DP = 2 DP = 3
Scale low -1999.9 -19999 -1999.9 -199.99 -19.999
Scale high 4553.6 45536 4553.6 455.36 45.536

7-4 Data Conversion

The word data are regarded as unsigned ( positive ) data in the
Modbus message. However, the actual value of the parameter may
be negative value with decimal point. The high/low scale values for
each parameter are used for the purpose of such conversion.
Let M = Value of Modbus message
A = Actual value of the parameter
SL = Scale low value of the parameter
SH = Scale high value of the parameter
The conversion formulas are as follows:
65535 ( A SL)
M=
SH-SL
SH-SL
A= M + SL
65535

7-5 Communication Examples :

Example 1: Down load the default values via the programming port
The programming port can perform Modbus communications
regardless of the incorrect setup values of address, baud, parity, stop
bit etc. It is especially useful during the first time configuration for the
controller. The host must be set with 9600 baud rate, 8 data bits, even
parity and 1 stop bit.
The Modbus message frame with hexadecimal values is shown as
follows:

73 UM91001A
 01 10 00 00 00 34 68 4F 19 4E 83 4E 83
Addr. Func. Starting Addr. No. of words Bytes SP1=25.0 SP2=10.0 SP3=10.0

00 00 00 01 00 00 00 01 4D 6D 51 C4
LOCK=0 INPT=1 UNIT=0 DP=1 INLO=-17.8 INHI=93.3

4D 6D 63 21 4E 1F 00 02 00 00 00 64
SP1L=-17.8 SP1H=537.8 SHIF=0.0 FILT=2 DISP=0 PB=10.0

00 64 00 FA 00 00 00 00 4E 1F 00 01
TI=100 TD=25.0 OUT1=0 O1TY=0 O1FT=0 O1HY=0.1

00 B4 00 FA 00 00 00 00 00 02 4E 1F
CYC1=18.0 OFST=25.0 RAMP=0 RR=0.0 OUT2=2 RELO=0.0

00 00 4E 1F 00 01 00 B4 00 64 4E 1F
O2TY=0 O2FT=0 O2HY=0.1 CYC2=18.0 CPB=100 DB=0

00 02 52 07 00 00 00 01 00 00 00 01
ALFN=2 REHI=100.0 ALMD=0 ALHY=0.1 ALFT=0 COMM=1

00 01 00 02 00 01 00 00 00 00 00 02
ADDR=1 BAUD=2 DATA=1 PARI=0 STOP=0 SEL1=2

00 03 00 04 00 06 00 07 00 08 00 0A
SEL2=3 SEL3=4 SEL4=6 SEL5=7 SEL6=8 SEL7=10

00 11 Hi Lo
SEL8=17 CRC16

UM91001D 74
Example 2: Read PV, SV, MV1 and MV2.
Send the following message to the controller via the COMM port or
programming port:
03 00 H'40 00 04 Hi Lo
H'80
Addr. Func. Starting Addr. No. of words CRC16
Example 3: Perform Reset Function (same effect as pressing R key)
Query
06 00 H'48 H'68 H'25 Hi Lo

Addr. Func. Register Addr. Data Hi/Lo CRC16

Example 4: Enter Auto-tuning Mode
Query
06 00 H'48 H'68 H'28 Hi Lo

Addr. Func. Register Addr. Data Hi/Lo CRC16

Example 5: Enter Manual Control Mode
Query
06 00 H'48 H'68 H'27 Hi Lo

Addr. Func. Register Addr. Data Hi/Lo CRC16

Example 6: Read All Parameters
Query
03 00 00 00 H'50 Hi Lo

Addr. Func. Starting Addr. No. of words CRC16

Example 7: Modify the Calibration Coefficient
Preset the CMND register with 26669 before attempting to change the
calibration coefficient.
06 00 H'48 H'68 H'2D Hi Lo

Addr. Func. Register Addr. Data Hi / Lo CRC16

75 UM91001D
Table A.1 Error Codes and Corrective Actions
Error Display Error Description
Code Symbol Corrective Action

Illegal setup values been used: Check and correct setup values of
Before COOL is used for OUT2, OUT2, PB, TI and OUT1. IF OUT2
DIRT ( cooling action ) has already is required for cooling control, the
been used for OUT1, or PID mode control should use PID mode ( PB
4 is not used for OUT1 ( that is PB = 0, TI = 0 ) and OUT1 should
= 0, and / or TI = 0 ) use reverse mode (heating action)
, otherwise, don't use OUT2 for
cooling control.
Communication error: bad function Correct the communication
10 code software to meet the protocol
requirements.
Communication error: register Don't issue an over-range
11 address out of range register address to the slave.
Communication error: attempt Don't write a read-only data or a
14 to write a read-only data or a protected data to the slave.
protected data
Communication error: write a Don't write an over-range data
15 value which is out of range to a to the slave register.
register
1.The PID values obtained after
auto-tuning procedure are out
of range. Retry auto-tuning.
2.Don't change set point value
Fail to perform auto-tuning during auto-tuning procedure.
26 3.Use manual tuning instead of
function
auto-tuning.
4. Don't set a zero value for PB.
5. Don't set a zero value for TI.
6. Touch RESET key
29 EEPROM can't be written correctly Return to factory for repair.

30 Cold junction compensation for

Return to factory for repair.
thermocouple malfunction
Input sensor break, or input
current below 1 mA if 4-20 mA is Replace input sensor.
39
selected, or input voltage below
0.25V if 1 - 5V is selected
A to D converter or related
40 Return to factory for repair.
component(s) malfunction

UM91001A 76