Fireye 25U3-2000 Modbus Memory Map

Anybody please who's done linking to a.m. flame detector amplifier, can help confirm register address and data format/range for the following:

1) Scanner A Pulse Rate - Address: 40774 (decimal)

2) Scanner B Pulse Rate - Address: 40775 (decimal)

3) Data range, using Modbus Function Code 3 for Read Holding Registers and the data being 16-bit: 0 to 65535 unsigned integer; or -32768 to 32767 signed integer.

MTIA.

Thank you Dan for the response. I have a text document with the Modbus map for the 25SU3-2000; can I upload it? Below is an extract of the relevant data/address for the scanner values.

With regards to the values -- the supposed range for the scanner values is 0 to 1900 pulses/sec. From previous experiences, I've had come across 16-bit integer values being scaled 0 to 4095, 0 to 65535, -32768 to 32767, 0 to 32767, etc.

PRODUCTION 25SU3-2000 COMMUNICATION LOGICAL MEMORY MAP



Revised: October 31, 1993

May 8,1994 139-940-3


...(other text removed)...

MODBUS PROTOCOL MEMORY MAP

PLC WORD DATA

ADDRESS ADDRESS LENGTH

COMMAND FNC LOW HIGH (BYTES)



WORD READ: 03H (see pages 7 ‑ 16) Appendix A



Device Type and revision # 00H,03H 600 2

Read Stored Password 02H,03H 601 2

Device type and revision # p.13 04H,03H 602 4

Scanners and relay status p.14 06H,03H 603 8

Logic Option 1 Setpoints p.15 08H,03H 604 8

Logic Option 2 Setpoints p.16 0AH,03H 605 8

Device type and revision # p.13 0CH,03H 602 4

...(other text removed)...

READ SCANNER & RELAY STATUS:


PLC word address (octal) = 603

Logical address = 006H,003H



returns 8 bytes



d1 - d2 SCANNER A PULSE RATE

d3 - d4 SCANNER B PULSE RATE

d5 FLAME RELAY STATUS

0 = de-energized

1 = engergized

d6 MARGINAL ALARM RELAY STATUS

0 = de-energized

1 = engergized

d7 - d8 ANALOG OUTPUT PERCENT




READ LOGIC OPTION 1 SETPOINTS



PLC word address (octal) = 604

Logical address = 008H,003H



returns 8 bytes:



d1 Scanner Option selected

0 = A ONLY

1 = B ONLY

2 = A PLUS B

3 = A OR B

4 = A AND B

5 = A XOR B



d2 - d3 Flame relay on threshold

d4 - d5 Flame relay off threshold

d6 - d7 Marginal alarm threshold

d8 Flame Failure Response Time

0 = 45FS1

1 = 1 second

2 = 2 seconds

3 = 3 seconds

4 = 4 seconds

5 = 5 seconds

6 = 6 seconds

Click to expand...

I'm having difficulty with what Register Address to use for Function Code 03 -- the "PLC word address (octal)", or the "Logical address".

READ SCANNER & RELAY STATUS has 8 bytes of data, and Register Address of either 603 (octal) or 006H,003H (low, high PLC word address).

The next set of data, READ LOGIC OPTION 1 SETPOINTS, also has 8 bytes of data, and Register Address of either 604 (octal) or 008H,003H (low, high PLC word address).

The octal address incremented by 1, and the hex address incremented by 2; yet the number of data bytes was 8, or 4 Modbus 16-bit registers.

AMTIA.

didn't quite get right the formatting of the quoted text above... any suggestions?

To attach a file, scroll down beneath the text entry box used when replying and there's a button labeled "attach files" that opens a window with browse and upload functions. It only shows up in the mode when replying or starting a new thread. Once you've uploaded a file, you can copy the 'link' from that window and paste it into the text entry box, but I'm pretty sure the link appears at the bottom of the text entry box by default.

If you preview the post ("preview post" button), it will be apparent whether the link to the file is there or not.

This has to be one of the most confused Modbus descriptions I've ever run into.

I'm guessing that you can get either relay status or the optional set points, but not both, because the quantity of 8 contiguous bytes of data for adjacent addresses would overlap, with the addresses being only indexed only by either 1 octal or 2 hex apart from one another.

The 8 byte return for the relay status could make sense:

relay status:
d1 A pulse rate (0-1900) 2 bytes, a 16 bit integer
d3 B pulse rate (0-1900) 2 bytes, a 16 bit integer
d5/6 2 bytes total in one 16 bit integer
d5 high byte (?) flame relay status, 0 or 1
d6 low byte (?) marginal alarm relay status 0 or 1
d7 analog output, percent, 0-100, 16 bit integer

8 bytes would be four 16 bit integers, which could be broken out fairly easily. Being odd numbered data bytes, it works out OK.

But that concept falls apart for the read logic optional setpoint because the multi byte words fall across, since the data is even numbered. Not that it can't be parsed out on the receive end, but . . .
d1 is one byte
d2/d3 is two bytes
d4/d5 is two bytes
d6/d7 is two bytes
d8 is one byte.

When d1 & d2 are part of one 16 bit data word, and d3 & d4 are part of another, it makes it a lot more difficult to parse it out.

But I can't see how one gets 8 byte returns from two different addresses that are only indexed by only one. That makes no sense, unless the choice is one set of data or the other, not both ? ?

The octal/hex addressing stumps me.

Octal 603 is binary 110 000 011 = 387 decimal
octal 604 is binary 110 000 100 = 388 decimal

It is not unusual to find addresses in decimal for the 03 command to be stated assuming they fall in the range 4xxxx.

So, one thought might be 40387, minus or plus one for offset.

Or hex addresses 40006 or 40008 ?

How did you come up with 40774 decimal for an address?
774 = 387 x 2 ?

I'd guess that since none of these values seem to need a negative range, the format is probably unsigned integer, but that's a guess.

Sorry I haven't been any help to you.

Dan

Attached the Modbus map from Fireye.

Got confirmation from the good people at Fireye that I need to do a 2-register block read starting at address 40774 to get the Scanner A&B Pulse Rates.

40774 came from "06H,03H" (low word, high word) -- 0306H -> 774, in 4xxxx format.

Thank you for the help in sorting this matter out.

What a strange notation for 0306H.

Thanks for the feedback, one never knows when something like this will come up again.

Dan

Any body can help

danw said:

What a strange notation for 0306H.

Thanks for the feedback, one never knows when something like this will come up again.

Dan

Click to expand...

Dear Guys,

I am trying to build a Modbus communication with fireye 25SU3-2000.

Actually I am trying to read the flame counts into Foxboro DCS through Modbus communication.

I am using function code 3 and I build a 2-register block read starting at address 40774 to get the Scanner A&B Pulse Rates

But I am getting strange reading which I am not able to understand what it's representing in Fireye Module.

On the block configured to address 40774 I am getting a continuous reading of 13125 regardless the flame is ON or OFF.

On the block configured to address 40775 I am getting a continuous reading of 4 regardless the flame is ON or OFF.

Can any one explain me these unknown readings?

Please anybody can help?

Thnx a lot

Could you please dump both the full modbus request and reply in hex?
That is to say each message byte by byte in hexadecimal like:
01 03 00 00 00 01 xx xx
Which would be a request for a single value at Modicon register 40001 from Modbus address 1. At the xx xx there should be a valid crc.