ControlEdge HC900 Controller Communications User Guide

1. Introduction

1.1 Overview

Communication interfaces

The ControlEdge HC900 controller provides Modbus communication support on three communication interfaces.

 Network port: Modbus TCP on an Ethernet connection

 Serial Port S1 RS232/RS485 selectable port. (Default RS232.): Modbus RTU

 Serial Port S2 RS232/RS485 selectable port. (Default RS485.): Modbus RTU

View or print addresses

You can print out the Modbus addresses of various parameters of the configuration (signal tags, PID loops, SP programmer, etc.) using the HC Designer report functions. With HC Designer Ver. 2.1 and later, these reports may also be exported to .csv files for view/manipulation in a spreadsheet and possible import to other HMI applications.

Fixed map or custom map

The type of addressing available: fixed or custom.

1.2 Modbus/TCP Interface

Introduction

ControlEdge HC900 controllers support the Modbus/TCP (also called Modbus TCP/IP or Modbus Ethernet) protocol for communications with third party HMI and SCADA software via a direct Ethernet TCP/IP connection.

The controller’s Ethernet 10/100Base-T Host port is used for the Modbus/TCP connection. Ethernet TCP allows multiple concurrent connections to hosts for data interchange. The ControlEdge HC900 (C30/C50) supports 5 concurrent host connections using Modbus/TCP protocol messaging via this port; ControlEdge HC900 (C70/C70R) supports 10.

Interface Preparation

ATTENTION

To access the controller you must have a current Process Control Designer configuration file available. Some data is referenced relative to number, such as Signal Tags and Variables.

Other principal blocks, such as PID blocks, have offsets for parameter access dependent on the order in which the blocks were placed on the Function Block Diagram.

It is strongly recommended that you upload the controller configuration using the Process Control Designer configuration tool to assure that you have a current configuration.

The Process Control Designer tool provides a series of reports for use in Modbus Address identification. The "Tag Information" report lists the variables and Signal Tags in numeric order along with their Modbus Addresses. A "Block Modbus Address" report lists the starting addresses for all principal blocks configured, identifying the offset.

Modbus/TCP Protocol

Modbus/TCP protocol, developed by Groupe Schneider’s Modicon Division, is a popular, open standard for data interchange over Ethernet TCP/IP networks using a Modbus RTU command structure.

It is simply an encapsulation of Modicon’s Modbus RTU protocol within a TCP/IP frame as shown below, which includes header information and the Modbus frame.

The Open Modbus/TCP Specification is followed with respect to the physical, data link, and network layers. The message structure within the Modbus frame uses standard Modbus RTU function codes.

The Address part of the Modbus frame is not used (set to 00) since there is no sub-addressing intended or required. The controller IP address is the identifying address, set independently at the controller.

The error checking is supported by TCP/IP network protocols and not part of the Modbus frame.

The Transaction Identifiers and Protocol Identifiers in the header are normally all 0’s (4 bytes total) while the Length field identifies the number of bytes in the Modbus frame. The controller will transmit the correct number of bytes for the remainder of the frame. However, the controller does not check this field for messages received.

The standard IEEE 32-bit floating point and 16-bit integer formats are used.

Parameter Addressing

The definition in Table 6-1 is the fixed map overview listing starting and ending addresses.

Greater detail for parameter addressing relating to a particular function class (e.g, loops, setpoint programmer, signal tags) is in referenced sub-sections. Function Codes 1, 2, 3, 4, 5, 6, 8, 16 (10h), and 17 (11h) are supported (see Table 4-1 Modbus/TCP and Modbus RTU Function Codes Definitions).

Examples for read or write access to parameters supported by the various function codes are provided in Sections 4.3 through 4.11.

ControlEdge HC900 Ethernet Communications Setup

See the ControlEdge HC900 Control (HC) Designer Users Guide, Doc. # 51-52-25-110 or respective HC Designer Help Files for setting up the following network parameters:

IP Address, Subnet Mask (optional), Default Gateway IP Address (optional)

1. Be sure the PC, HMI panel, or other Host device has a Network Interface Card (NIC) with an IP address (fixed or DHCP served) that allows access to controllers on the same or other subnet. Consult your IT department or network administrator for allocating IP addresses to the controllers as required.

2. You will need to set each controller’s IP address prior to network connection since every ControlEdge HC900 controller is shipped with the default IP address of 192.168.1.254. Placing multiple controllers on the same network before they have been given unique IP addresses will cause problems.

3. On the PC, use the Utilities Worksheet in the HC Designer software to set up the serial RS-232 connection to the controller at the desired baud rate. This will require a null modem cable.

4. Select the Set Controller’s Network Parameters button. Using the wizard (bottom radio button), select the PC COM port to be used, then set the controller’s new network parameters including IP address, Subnet Mask (if other than default, 255.255.255.0), and Default Gateway IP address (if required, otherwise leave at default 0.0.0.0). See your IT network administrator for proper entries. (Refer to the on-line help provided with the HC Designer software, Utilities Worksheet, Set Controller’s Network Parameters, for further details on this step).

Note: This setup will require the controller to be placed temporarily in the Program mode. After the new network parameters have been downloaded, the controller will conduct a Cold Start in its transition to RUN. This will cause an initialization if there is a current configuration in the controller.

The fixed IP address of each controller shall be set independently prior to placing on the network. See your IT systems administrator for allocating IP addresses, subnet masks, or default gateway IP address as necessary (network address filtering and routing may be necessary if the controller network access will not to be confined locally within the plant environment).

Ethernet 10/100Base-T Network Connections

Ethernet 10/100Base-T networks operating at 10/100MB/sec. are supported. A typical network arrangement is as shown below.

Setting Up the Modbus/TCP Double Register Format

The ControlEdge HC900 predominantly uses an IEEE floating point format for communicating data to software applications providing Modbus/TCP protocol communications drivers. A floating point value is sent as (2) consecutive 16-bit registers, each register of which consists of two 8-bit bytes. Some software packages require the registers and bytes to be sent in a certain order. The controller can be configured to deliver the data in four different byte orders.

The Process Control Designer software tool allows this order to be selected as follows:

1. Using the Utilities Worksheet in the HC Designer software, access the Set Controller Network Parameters button and make the selection to change the Modbus TCP Double Register Format (middle radio button).

2. With the Port selected for downloading this order (using a COM port or Network port), select the appropriate byte order format if the default (FP B) is not appropriate for the application. See Table 3-1, page 9.

3. Select Next and verify (by the response in the dialog box) that the change has been made in the controller. This order can be changed in the RUN mode.

The Modbus TCP double register transmission format selection, FP LB “Little Endian Byte-Swapped”, would be selected for interface to most third party software packages which use this format as standard. The default, FP B “Big Endian” is used with SpecView32 or Honeywell’s PlantScape/Experion/EBI software and follows the “Honeywell” default format of other control and recording products. It should be noted that most PC software packages offer a register (word) swap selection in their driver package anyway, so there should never be an incompatibility.

1.3 Modbus RTU RS232/RS485 Communication Ports

This implementation is designed to provide a popular data exchange format connecting the ControlEdge HC900 to both Honeywell and foreign master devices via the RS232 and RS485 communication ports. The Modbus RTU allows the instrument to be a citizen on a data link shared with other devices, which subscribe to the Modicon Modbus Protocol Reference Guide PI-MBUS-300 Rev. G specification.

These instruments DO NOT emulate any MODICON type device. The Modbus RTU specification is respected in the physical and data link layers. The message structure of the Modbus RTU function codes is employed and standard IEEE 32-bit floating point and integer formats are used. Data register mapping is unique to the ControlEdge HC900 and other Honeywell instruments. Section 6 describes the parameter mapping for the ControlEdge HC900.

Summary

The SP Programmer parameters are listed according to category related to program status and interaction, other programmer parameters and program segment mapping.

In the fixed map each SP Programmer is assigned to three non-contiguous sections of the map:

 SP Programmer parameters (Table 6-9)

 SP Programmer Additional parameters (Table 6-9, page 58)

 SPP Programmer segments (Table 6-10).

In a custom map the above parameters may be contiguous.

Function Code Support:

Read – Function Code 3

Write – Function Code 16 (10 Hex)

Considerations and Methods for Downloading. Operating, and Reading Status of SP Programs

A SP programmer interface can be developed (and recipes containing a SP profile can be created) in third party software using the parameters listed in the following table.

In creating a SP Programmer interface showing a number of segments, a graphic display might include a table referencing the maximum number of ramp/soak segments that you will be using for your process. The parameters to be referenced for each segment are listed in Table 6-10.

Procedure for Downloading Setpoint Profile

These steps are for programmer 1. For programmers 2, 3, 4, 5, 6, 7, and 8 adjust the register addresses accordingly by adding offset for starting addresses.

Table 6-7 is for downloading using Function Codes 3, 4, 6, 16.

If using a custom map, you need to know the addresses of the parameters referred to in this procedure. Use HC Designer to print a report showing the Modbus registers of the SP Programmers