Honeywell HC900 User Manual page 41

If a request is made to an address that does not exist in the map in Section 1, the controller will honor that
request and return zeros for that address. This behavior will greatly enhance the bandwidth on the link vs.
making several different requests for non-contiguous data elements. (i.e. Consider a controller that is
configured for AI #1 and AI #3 and for some reason AI #2 is an invalid request.) The contiguous method
would allow the read of AI #1 through AI #3 and the data location for AI #2 would be zeros.
Broadcast is not supported.
Query
The query message specifies the starting register and quantity of registers to be read. Registers are
addressed starting at zero: registers 1-16 are addressed as 0-15.
Example: Read analog inputs #1 and #2 (Rack #1, Module #1) addresses 0-3, as floating point values from
the controller at slave address 1.
Slave
Address
(00 for TCP)
TCP Example 00
RTU Example 01
Response
The register data in the response message is packed as two bytes per register. For each register, the first byte
contains the high order bits and the second contains the low order bits.
The floating point values require two consecutive registers. The byte order of the floating point number is
determined by the setting of the byte swap configuration value. In this example, and the examples that
follow, the byte swap order is FP B. Refer to subsection 1.3. The first 16 bits of the response contain the
IEEE MSB of the float value. The second 16 bits of the response contain the IEEE LSB of the float value.
If the master station requests only one register at an address of a floating point value, then half of a float
will be returned.
The Modbus RTU protocol has a single byte count for function code 04, therefore the Modbus RTU
protocol can only process up to 63 floating point values in a single request.
Example: Analog inputs #1 and #2 as floating point values where AI #1 = 100.0 and AI #2 =55.32
TCP Example
RTU Example
Revision 13
April 2017
Query message format for function code 04
Function Starting
Code Address
High
04 00
04 00
Response message format for function codes 04
Slave Function
Address Code
(00 for TCP)
00 04
01 04
HC900 Process Controller Communications User Guide
Modbus/TCP & Modbus RTU Function Codes
Function Code 04 - Read Input Registers
Starting Number
Address Addresses
Low High
00 00
00 00
Byte Data
Count
08 42 C8 00 00 42 5D 47 AE
(100) (55.32)
08 42 C8 00 00 42 5D 47 AE
(100) (55.32)
Number CRC
Addresses (RTU)
Low
04
04 CRC
Data CRC CRC
(RTU) (RTU)
CRC CRC
CRC
(RTU)
CRC
33