JUMO cTRON 04 User manual

JUMO cTRON 04/08/16
Compact controller
with timer and ramp function
B 70.2070.2.0
Interface Description
Modbus
2008-08-11/00492538
702071 702072 702074

Contents
1 Introduction 5
1.1 Preface ........................................................................................................ 5
1.2 Typographical conventions ....................................................................... 5
2 Protocol description 7
2.1 Master-Slave principle ............................................................................... 7
2.2 Transmission mode (RTU) ......................................................................... 7
2.3 Device address ........................................................................................... 8
2.4 Timing of the communication ................................................................... 8
2.5 Structure of the data blocks ................................................................... 11
2.6 Function codes ......................................................................................... 12
2.6.1 Read n words ............................................................................................. 12
2.6.2 Write one word ........................................................................................... 13
2.6.3 Write n words ............................................................................................. 14
2.7 Transmission format (integer, float and text values) ............................. 15
2.8 Checksum (CRC16) .................................................................................. 17
2.9 Error processing ...................................................................................... 18
3 RS485 interface 19
3.1 Connection diagram ................................................................................ 19
3.2 Configuration ............................................................................................ 20
4 Modbus addresses 21
4.1 Process data ............................................................................................ 21
4.2 Set point values ........................................................................................ 23
4.3 Controller parameters ............................................................................. 23
4.4 Configuration ............................................................................................ 23
4.5 Commands ............................................................................................... 24
4.6 RAM memory ............................................................................................ 25

Contents

5
1 Introduction
1.1 Preface
This operating manual is addressed to the system manufacturer with adequate
technical background and PC related knowledge.
Please read this operating manual prior to commissioning the device. Keep
the manual in a place accessible to all users at all times. Your comments are
appreciated and may assist us in improving this manual.
All necessary settings are described in this operating manual. Should
problems be encountered during commissioning, please refrain from carrying
out any manipulations that are not described in the manual. Any such
intervention will jeopardize your warranty rights. Please contact the nearest
subsidiary or the head office.
1.2 Typographical conventions
Warning signs:
Caution
Note signs:
Note
Reference
Number types:
Hexadecimal
number
AThis symbol is used when there may be damage to equipment or
data if the instructions are ignored or not followed correctly!
HThis symbol is used when your special attention is drawn to a
remark.
vThis symbol refers to further information in other manuals,
chapters or sections.
0x0010 A hexadecimal number is identified by „0x“ preceding the actual
number (here: 16 decimal).

1 Introduction
6

7
2 Protocol description
2.1 Master-Slave principle
Communication between a master (e.g. PC) and a slave (e.g. measuring and
control system) using Modbus takes place according to the master-slave
principle, in the form of data request/instruction - response.
The master controls the data exchange, the slaves only have a response
function. They are identified by their device address.
2.2 Transmission mode (RTU)
The transmission mode used is the RTU mode (Remote Terminal Unit). Data is
transmitted in binary format (hexadecimal) with 8 bits. The LSB (least
significant bit) is transmitted first. The ASCII operating mode is not supported.
Data format The data format describes the structure of a character transmitted. The
following data format options are available:
Master
Slave 1 Slave 2 Slave n
Data word Parity bit Stop bit
1/2 bit Number of bits
8 bits — 1 9
8 bits even 1 10
8 bits odd 1 10
8 bits — 2 10

2 Protocol description
8
2.3 Device address
The device address of the slave can be set between 0 and 254. Device
address 0 is reserved.
There are two different forms of data exchange:
Query Data request/instruction by the master to a slave via the corresponding device
address.
The slave addressed responds.
Broadcast Instruction by the master to all slaves via the device address 0 (e.g. to transmit
a specific value to all slaves).
The connected slaves do not respond. In such a case, the correct acceptance
of the value by the slaves should be checked by a subsequent readout at each
individual slave.
Data request with the device address 0 is meaningless.
2.4 Timing of the communication
Start and end of a data block are marked by transmission pauses. The
maximum permitted interval between two consecutive characters is three
times the transmission time required for a single character.
The character transmission time (time required to transmit one single
character) depends on the baud rate and the data format used (stop bits and
parity bit).
For a data format of 8 data bits, no parity bit and one stop bit, this is:
character transmission time [ms] = 1000 * 9 bit/baud rate
For the other data formats, this is:
character transmission time [ms]
= 1000 * (8 bits+parity bit+stop bit(s)) bit/baud rate
HA maximum of 31 slaves can be addressed via the RS485 interface.

9
2 Protocol description
Timing
Example Marker for end of data request or end of response for a 10/9 bit data format
Waiting time = 3 characters * 1000 * 10 bit/baud rate
Data request from master
transmission time = n characters * 1000 * x bit/baud rate
Marker for end of data request
3 characters * 1000 * x bit/baud rate
Processing of data request by the slave (≤250ms)
Response of the slave
transmission time = n characters * 1000 * x bit/baud rate
Marker for end of response
3 characters * 1000 * x bit/baud rate
Baud rate [baud] Data format [bit] Waiting time [ms]
(3 characters)
38400 10 0.79
90.71
19200 10 1.57
91.41
9600 10 3.13
92.82

2 Protocol description
10
Timing
scheme A data request runs according to the following timing scheme:
t0End marker = 3 characters
(time depending on the baud rate)
t1This time depends on the internal processing.
The maximum processing time is 250 ms.
The minimum response time, which can be set is required by the RS485
interface in the master, to be able to switch over the interface drivers from
transmit to receive.
t2This time is needed by the slave to change from transmit back to receive.
The master has to observe this waiting time before presenting a new data
request. This time must always be observed, even when the new data
request is directed to another device.
RS485 interface: t2= 10ms
No data requests from the master are permitted during t1and t2 and during
the slave response time. Data requests made during t1and t2are ignored by
the slave. Data requests during the response time will result in the invalidation
of all data currently on the bus.
HA minimum response time can be set in the device under the menu
point item „Interface“. This preset time is the minimum waiting time
before an answer is transmitted (0…500 ms). If a smaller value is set,
then the response time may be longer than the preset value (internal
processing takes longer), the device answers as soon as internal
processing is completed. The preset time of 0 ms means that the
device responds at the maximum possible speed.
Master
Slave
Data request
Response
t
Data request
t
0t1t2
t0

11
2 Protocol description
2.5 Structure of the data blocks
All data blocks have the same structure:
Data structure
Each data block contains four fields:
Slave address device address of a specific slave
Function code function selection (read, write words)
Data field contains the following information:
- word address
- number of words
- word value(s)
Checksum detection of transmission errors
Slave
address
Function
code
Data field Checksum
CRC16
1 byte 1 byte x byte 2 bytes

2 Protocol description
12
2.6 Function codes
The functions described in the following are available for the readout of
measured values, device and process data as well as to write specific data.
Function-
overview
2.6.1 Read n words
This function is used to read n (n ≤32) words starting from a specific address.
Data request
Response
Example Reading the W1 and W2 set point values (2 words each)
Address of first word = 0x3100 (W1 set point value)
Data request:
Response (values in the Modbus float format):
Function
number Function Limitation
0x03 or 0x04 Read n words max. 32 words (64 bytes)
0x06 Write one word max. 1 word (2 bytes)
0x10 Write n words max. 32 words (64 bytes)
vPlease refer to Chapter 2.9 Error processing, Page 18 if the device
does not react to these functions or emits an error code.
Slave
address
Function
x03 or 0x04
Address
first word
Number of
words
(max. 32)
Checksum
CRC16
1 byte 1 byte 2 byte 2 byte 2 byte
Slave
address
Function
0x03 or 0x04
Number of
bytes read
Word
value(s)
Checksum
CRC16
1 byte 1 byte 1 byte x byte 2 byte
01 03 3100 0004 4AF5
01 03 08 0000 41C8 0000 4120 4A9E
Set point value
W1
(25.0)
Set point value
W2
(10.0)

13
2 Protocol description
2.6.2 Write one word
For the Write Word function, the data blocks for instruction and response are
identical.
Instruction
Response
Example Write the limit value AL of limit comparator 1 = 275.0
(Value = 0x80004389 in the Modbus float format)
Word address = 0x0057
Instruction: Write the first part of the value
Response (as instruction):
Instruction: Write the second part of the value (next word address)
Response (as instruction):
Slave
address
Function
0x06
Word address Word value Checksum
CRC16
1 byte 1 byte 2 byte 2 bytes 2 byte
Slave
address
Function
0x06
Word address Word value Checksum
CRC16
1 byte 1 byte 2 byte 2 byte 2 byte
01 06 0057 8000 59DA
01 06 0057 8000 59DA
01 06 0058 4389 F88F
01 06 0058 4389 F88F

2 Protocol description
14
2.6.3 Write n words
This function is used to write n (n ≤32) words starting from a specific address.
Instruction
Response
Example Writing the W1 and W2 set point values (2 words each)
Word address = 0x3100 (W1 set point value)
Instruction:
Response:
Slave
address
Function
0x10
Address
first word
Number
of words
(max. 32)
Number
of
words
Word
value(s)
ChecksumC
RC16
1 byte 1 byte 2 byte 2 byte 1 byte x byte 2 byte
Slave
address
Function
0x10
Address
first word
Number of
words
Checksum
CRC16
1 byte 1 byte 2 byte 2 byte 2 byte
01 10 3100 0004 08 0000 41C8 0000 4120 2A42
Set point value
W1
(25.0)
Set point value
W2
(10.0)
01 10 3100 0004 CF36

15
2 Protocol description
2.7 Transmission format (integer, float and text values)
Integer values Integer values are transmitted via the Modbus in the following format:
The high byte first, followed by the low byte.
Example Request of the integer value of address 0x0021, if value "4" (word value
0x0004) is written under this address.
Request: 01 03 0021 0001 (+ 2 bytes CRC16)
Response: 01 03 02 0004 (+ 2 bytes CRC16)
Float values In the case of float values, the Modbus operates with the IEEE-754 standard
format (32bits), the only difference being that byte 1 and 2 are changed over
with byte 3 and 4.
Single-float format (32bit) as per IEEE 754standard
S - sign bit
E - exponent (two's complement)
M - 23bits normalized mantissa
Modbus float format
Example Request of the float value of address 0x0035, if value "550.0" (0x44098000 in
IEEE-754 format) is written under this address.
Request: 01 03 0035 0002 (+ 2 bytes CRC16)
Response: 01 03 04 8000 4409 (+ 2 bytes CRC16)
Once transmission from the device is completed, the bytes of the float value
need to be changed over accordingly.
Float value
SEEEEEEE EMMMMMMM MMMMMMMM MMMMMMMM
Byte 1 Byte 2 Byte 3 Byte 4
Modbus address x Modbus address x+1
MMMMMMMM MMMMMMMM SEEEEEEE EMMMMMMM
Byte 3 Byte 4 Byte 1 Byte 2
HA large number of compilers (e.g. Microsoft Visual C++) store the float
values in the following order:
Address x Address x+1 Address x+2 Address x+3
MMMMMMMM MMMMMMMM EMMMMMMM SEEEEEEE
Byte4Byte3Byte2Byte1
HPlease find out the way float values are stored in your application.
After the request, it might be necessary to change the bytes over in
the interface program you are using.

2 Protocol description
16
Character
strings
(texts)
Character strings (texts) are transmitted in the ASCII format.
Example for
data type
TEXT4
Read the text (here: "AbC ") under address 0x0067 (a max. of 4 characters can
be saved)
ASCII code for "AbC " (with one space at the end):
0x41, 0x62, 0x43, 0x20
Request: 01 03 0067 0002 (+ 2 byte CRC16)
Slave address = 01
Function = 03, i.e. read n words
Address = 0067
Number of words to be read = 0002, because of the maximum of 4
characters
Response: 01 03 04 41 62 43 20 (+ 2 byte CRC16)
Slave address = 01
Function = 03, i.e. read n words
Number of bytes read = 04
Variant:
ASCII code for "Ab" (without a space at the end):
0x41, 0x62, 0x00
ASCII 0x00 ("\0") marks the end of the character string.
During transmission, 0x00 is additionally appended to obtain an even number
of characters.
Response in this case: 01 03 04 41 62 00 00 (+ 2 byte CRC16)
HTo mark the end, the last character to be transmitted can be a "\0"
(ASCII code 0x00). Characters after this mark are without
significance.
The address tables show the max. possible number of characters in a
data type, e.g. "TEXT24" (24 characters). When an end mark is used,
then only 23 readable characters are available for the text in this
example.
If no end mark is used, the use of the maximum number of characters
(e.g. TEXT8 = 8 characters) indicated in the data type is required. This
prevents characters still contained in the memory from being
appended to the text.
Knowing that the transmission of texts takes place word by word (16
bits), 0x00 is additionally appended where an odd number of
characters is used (incl. "\0").

17
2 Protocol description
2.8 Checksum (CRC16)
The checksum (CRC16) serves to recognize transmission errors. If an error is
identified during evaluation, the device concerned does not respond.
Calculation
scheme
Example Data request: Read two words, starting at address 0x00CE
(CRC16 = 0x92A5)
Response: (CRC16 = 0xF5AD)
CRC = 0xFFFF
CRC = CRC XOR ByteOfMessage
For (1 to 8)
CRC = SHR(CRC)
if (flag shifted right = 1)
then else
CRC = CRC XOR
0xA001
while (not all ByteOfMessage processed);
HThe low byte of the check sum is the first to be transmitted, then the
high byte.
07 03 00 CE 00 02 A5 92
CRC16
07 03 04 00 00 41 C8 AD F5
Wo rd 1 Word 2 CRC1 6

2 Protocol description
18
2.9 Error processing
Error codes The following error codes exist:
1invalidfunction
2 invalid parameter address or too many words
are to be read or written
8 write access to parameter denied
Response in
the
event of an
error
0x80 is used to set the function code to its OR status, i.e. the MSB (most
significant bit) is set to 1.
Example Data request:
Response (with error code 2):
Special cases The slave not responding can have the following causes:
- the baud rate and/or data format of Master and Slave are not compatible
- the device address used does not coincide with that of the slave address
- the checksum (CRC16) is not correct
- the instruction from the Master is incomplete or over-defined
- The number of words to be read is zero.
In these cases the data request should be transmitted again once the timeout
time (2 s) has elapsed.
Slave
address
Function
XX OR 80h
Error code Checksum
CRC16
1 byte 1 byte 1 byte 2 bytes
01 03 40 00 00 04 CRC16
01 83 02 CRC16

19
3 RS485 interface
3.1 Connection diagram
Connection
diagram
Type 702071
Connection
diagram
Type 702072
and
Type 702074
(1) RS485 interface
vThe devices of this controller series can be ordered with an RS485
interface as an option. Please refer to the type sheet 70.2070 or the
operating manual B 70.2070.0 (type explanation) for the order
specifications.
1
2
5
6
N(L-)
L1(L+)
14
13
17
20
21
22
23
RxD/TxD
19
18
24 (1)
-
+
HConnect the interface line shielding to earth on one side in the
switch cabinet.
1
2
5
6
N(L-)
L1(L+)
12
13
15
16
17
20
21
22
23 RxD/TxD
19
18
24 (1)
-
+

3 RS485 interface
20
3.2 Configuration
The following table shows the possible Modbus interface settings to be
carried out in the configuration level (ConF ➔IntF) and/or in the setup program.
vFor more detailed information about configuration, please refer to
operating manual B 70.2070.0.
Symbol Value/
Selection Description
Baud rate bdrt 0
1
2
9600 bps
19200 bps
38400 bps
Data format dFt 0
1
2
3
8 data bits, 1 stop bit, no parity
8 data bits, 1 stop bit, odd parity
8 data bits, 1 stop bit, even parity
8 data bits, 2 stop bits, no parity
Device address Adr 0…1…255 Address in data network
Addresses 0 and 255 are reserved for specific
purposes and should not be used here.
Minimum
response time
(Setup) 0…500ms Minimum time period that elapses between the
request of a device in the data network and the
response of the controller (can only be adjusted
via the setup program).
Factory settings are shown bold.
HWhen the communication takes place via the setup interface, the
RS485 interface is inactive.