Thanks to visit codestin.com
Credit goes to www.scribd.com

0% found this document useful (0 votes)
22 views24 pages

Modbus Protocol

Uploaded by

M. Nur Prasetiyo
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as XLSX, PDF, TXT or read online on Scribd
0% found this document useful (0 votes)
22 views24 pages

Modbus Protocol

Uploaded by

M. Nur Prasetiyo
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as XLSX, PDF, TXT or read online on Scribd
You are on page 1/ 24

Data format: 9600 8-bit data, 1 stop bit, no parity

Support modbus protocol 3 6 16 Data format is high order first, low order last

Message protocol format: read register, request frame

BYTE 0 1 2 3 4 5 6

Field definition ADDR CMD MSB LSB MSB LSB CRC-L

description 0xD2 0x03 Register start address Number of registers N CRC-16 check
Description: D2 03 00 0C 00 01 57 AA
D2 is the slave address, 03 is the read command, 000C is the register start address, 0001 means that the
number of read registers is 1, that is, the read command, and 57AA is the CRC check code.

Regular response frame

BYTE 0 1 2 3 4 5 6

Field definition ADDR CMD Length MSB LSB MSB LSB

Data
The value of the first ... the value of the
description 0xD2 0x03 length
register Nth register
L=2*N
Description: N is register data
D2 03 02 00 01 FC 56
D2 is the slave address, 03 is the read command, 02 is the length of the read data, 0001 means the value of the first
register read, that is, the host command is the discharge state, and FC56 is the CRC check code.

Message protocol format: write register, request frame

BYTE 0 1 2 3 4 5 6

Field definition ADDR CMD MSB LSB MSB LSB CRC-L

description 0xD2 0x06 Register address Data CRC-16 check


"Description: D2 06 00 0C 00 01 9B AA
D2 is the slave address, 06 is the instruction to write a single holding register, 000C is the register address,
0001 is the host commanding battery discharge, and 9BAA is the CRC check code. "
Regular response frame
BYTE 0 1 2 3 4 5 6

Field definition ADDR CMD MSB LSB MSB LSB CRC-L

description 0xD2 0x06 Register address Data CRC-16 check

Note: The format of the normal response frame for writing a single holding register is the same as the request
frame.

Message protocol format: write multiple data registers, request frame


BYTE 0 1 2 3 4 5 6

Field definition ADDR CMD MSB LSB MSB LSB MSB

description 0xD2 0x10 Register start address Register length (N)) Data content (2N)
Description: D2 10 00 0C 00 02 00 01 00 02 7D 65
0xD2 is the slave address, 0x10 indicates the instruction to write multiple data registers, 0x000C is the register start add
0x0002 indicates two registers are written consecutively, 0x0001 indicates the data written in the first register, 0x0002 ind
second register writes Data, 0x7D65 represents CRC16 check code.

Regular response frame

BYTE 0 1 2 3 4 5 6

Field definition ADDR CMD MSB LSB MSB LSB CRC-L

description 0xD2 0x10 Register start address Register length (N)) CRC-16 check

Description: D2 10 00 0C 00 02 92 68
0xD2 is the slave address, 0x10 is the instruction to write multiple data registers, 0x000C is the register
start address, 0x0002 means to write two registers in succession, and 0x9268 means the CRC16 check code.
low order last

CRC-H

CRC-16 check

001 means that the


de.

7 8

CRC-L CRC-H

CRC-16 check

01 means the value of the first


k code.

CRC-H

CRC-16 check

the register address,


7

CRC-H

CRC-16 check

e same as the request

me
7 8 9

LSB CRC-L CRC-H

Data content (2N) CRC-16 check

ers, 0x000C is the register start address,


tten in the first register, 0x0002 indicates the

CRC-H

CRC-16 check

00C is the register


e CRC16 check code.
Data format: 9600 8-bit data, 1 stop bit, no parity
Support modbus protocol 3 6 16 The data format is high order first, low order last

Address code Type of data Read and write


0x00~0x1F R
0x20~0x27 R
0x28 R
0x29 R
0x2A R
0x2B R
0x2C R
0x2D R
0x2E R
0x2F R
0x30 R
0x31 R
unsigned int
0x32 R
0x33 R
0x34 R
0x35 R
0x36 R
0x37 R
0x38 R
0x39 R
0x3A R
0x3B R
0x3C R
0x3D R
0x3E unsigned int R
0x3F unsigned int R
0x40 unsigned int R
0x41 unsigned int R
0x42 unsigned int R
0x43 unsigned int R
0x44 unsigned int R
0x45 unsigned int R
0x46 unsigned int R
0x47~0x56 unsigned int R
0x57
0x58~0x59
0x5A~0x5B
0x5C
0x5D
0x5E
0x5F
0x60~0x67

0x80 R/W
0x81 R/W
0x82 R/W
0x83 R/W
0x84 R/W
0x85 R/W
0x86 R/W
0x87 R/W
0x88 R/W
0x89 R/W
0x8A R/W
0x8B R/W
0x8C R/W
0x8D R/W
0x8E R/W
0x8F R/W
0x90 R/W
0x91 R/W
0x92 R/W
0x93 R/W
0x94 R/W
0x95 R/W
0x96 R/W
0x97 R/W
0x98 R/W
0x99 R/W
0x9A R/W
0x9B R/W
0x9C R/W
0x9D R/W
0x9E R/W
0x9F R/W
0xA0 R/W
0xA1 R/W
0xA2 R/W
0xA3 R/W
0xA4 R/W
0xA5 R/W
0xA6 R/W
0xA7 W
0xA8 R/W
0xA9~0xB0 R
0xB1~0xB8 R
0xB9~0xC8 R
0xC9~0xCB R/W
0xCC~0xCD R

0xCE~0xDE R

0xF0 W
0xF1 W
0xF2 W
0xF3 W
Protection board protocol description

Content Range
Single battery voltage, every two bytes is a battery voltage 0--5000
Battery temperature 0--140(-40至100℃)
Total battery voltage
Current data 0--65535
SOC 0--65535
Maximum cell voltage 0--65535
Lowest cell voltage 0--65535
Maximum monomer temperature 0--65535
Minimum monomer temperature 0--65535
Charge and discharge state 0--65535
Battery remaining capacity
Number of batteries
Number of battery temperature sensors
Number of battery cycles
Equilibrium 0--65535
Charging MOS status 0--65535
Discharge MOS state 0--65535
Average voltage 0--65535
Voltage difference 0--65535
power 0--65535
Fault status 1 0--65535
Fault status 2 0--65535
Fault status 3 0--65535
Fault state 4 0--65535
Remaining mileage 0--65536
Reserved signal 1 0--65536
Reserved signal 2 0--65536
Reserved signal 3 0--65536
Reserved signal 4 0--65536
Reserved signal 5 0--65536
Reserved signal 6 0--65536
Reserved signal 7 0--65536
Reserved signal 8 0--65536
Single battery voltage, every two bytes is a battery voltage 0--5000
GPS valid sign 0--65535
longitude 0--65535
latitude 0--65535
speed 0--65535
Altitude 0--65535
Number of satellites 0--65535
Protection board data acquisition normal flag 0--65536
IMEI code 0--65537

Rated Capacity 0--65535


Single reference voltage 0--65535
Number of acquisition boards 0--65535
Number of units in acquisition board 1 0--65535
Number of units in acquisition board 2 0--65535
Number of units in acquisition board 3 0--65535
Number of temperature of acquisition board 1 0--65535
Number of temperature of acquisition board 2 0--65535
Number of temperature of acquisition board 3 0--65535
type of battery 0--65535
Sleep waiting time 0--65535
Unit voltage is too high level one alarm 0--65535
Unit voltage is too high level two alarm 0--65535
Unit voltage is too low level one alarm 0--65535
Unit voltage is too low level two alarm 0--65535
The total pressure is too high level one alarm 0--65535
The total pressure is too high level two alarm 0--65535
The total pressure is too low level one alarm 0--65535
The total pressure is too low level two alarm 0--65535
High charging current level one alarm 0--65535
High charging current level two alarm 0--65535
High discharge current level one alarm 0--65535
High discharge current level two alarm 0--65535
Charging a high temperature level one alarm 0--65535
Charging a high temperature level two alarm 0--65535
Charging temperature is too low level one alarm 0--65535
Charging temperature is too low level two alarm 0--65535
High discharge temperature level one alarm 0--65535
High discharge temperature level two alarm 0--65535
Discharge temperature is too low level one alarm 0--65535
Discharge temperature is too low level two alarm 0--65535
The voltage difference is too large level one alarm value 0--65535
The voltage difference is too large level two alarm value 0--65535
The temperature difference is too large level one an alarm value 0--65535
The temperature difference is too large level two an alarm value 0--65535
Balanced opening voltage 0--65535
Balanced opening pressure difference 0--65535
Charge MOS tube switch control
Discharge MOS tube switch control
SOC settings
Power tube temperature protection alarm
Software version number 0--65535
Hardware version number 0--65535
Machine code
Parameter setting password
Production Date 0--65535

IP address ASCII

System restart
Shut down the system
Zero current
reset
Data calculation instructions
0.001 3550*0.001=3.550v
Temperature data offset 40, for example, when temperature data is
40, actual temperature = temperature data -40;
0.1V 30000
0.1A, 350*0.1=35.0v
Offset, the charging current is a negative number, and
the discharge is a positive number, (30080-30000)*0.1=8A, which is
the discharge current
0.001,800/1000=80%
1mv
1mv
1°C, temperature data offset 40, for example, when temperature
data is 40, actual temperature
1°C, temperature = temperature
data offset 40, for example, data
when-40;
temperature
data is 40, actual temperature = temperature data -40;
0 static, 1 charge, 2 discharge
0.1AH

Byte 0
Bit 0: Unit voltage is too high level one alarm
Bit
Byte
0: 1:0Unit
Off 1: Onvoltage is too high level 2 alarm
Byte
Bit 2:0Unit
Bit
0:
Bit 0: 1: Onvoltage
Charging
Off Charge MOS is over
too low level one alarm
temperature warning
Bit 0:
Bit 3: Discharge
1:
overcurrent
Unit voltage is too
MOS over
level
low 1 alarm
level 2 alarm
temperature warning
0:
BitOff
Bit 1: 1: Onpressure
4: Charge
Total overcurrent
is toosecondary
high level alarm
one alarm
Bit
Bit 2: Charging MOS temperature detection sensor failure
Bit 2:
1mV
Bit 5: Discharge
3: Total pressure
Discharge
overcurrent
MOS too highlevel
istemperature 1 alarm
level 2 alarm sensor failure
detection
Bit
Bit 3:
1mV 6: Discharge
Total pressureovercurrent
is too low secondary
one levelalarm
alarm
Bit
Bit 4:
4: Charging
SOC high MOS
level adhesion
alarm failure
W
Bit 5:
Bit 7: Discharge
Total pressureMOS isadhesion
too low level
failure2 alarm
Bit 5: SOC
"Byte 0: high MOS level alarm
Bit
Bit 6:
6: Charging open circuit fault
Bit
Byte
Bit 0:
7:1Discharge MOSalarm
SOC low
Current level
module failure
open circuit fault
Bit 1:
Bit 7: Low SOC
Internal level
total 2 alarm
pressure
0: One level alarm when charging detectiontemperature
module failureis too high
Bit
Byte2:
1:1Short
High circuit
charging protection
temperature failure
secondary alarm
Byte3:
Bit 2:1Low
The voltage prohibited
charging temperature charging
is too fault
low one level alarm
Bit 0:
0.1km
Bit 4:
0: AFE
One acquisition
level alarm chip
for failure
excessive pressure difference
Bit
Bit 3:
1: GPS
Low or
Single soft
charging switch disconnect
temperature
acquisition isdifference MOS
secondary
offline level 2 alarm alarm
Reserved
Bit
Bit 1:
5:
4: Excessive
Charging
High pressure
cabinet
discharge offline
temperature alarm
Bit
Bit 2:
2: Single
One
Reserved temperature
level sensor failure
alarmtemperature
of excessive temperature difference
Bit6~Bit7:
Bit
Bit 5:
3: High
EEPROMReserved"
discharge
storage secondary
failuredifference alarm
Bit 3: Excessive
Reserved
Bit 6: Discharge temperature secondary
temperature is too low one level alarm alarm
Bit
Bit 4: RTC clock
4~Bit7: failure
Reserved
Reserved
Bit
Bit 7:
5: Low discharge
Pre-charge temperature level 2 alarm
failed
Reserved
Bit 6: Vehicle communication failure
Reserved
Bit 7: Intranet communication module failure
Reserved
Reserved
Valid: 0xA5, other invalid
Valid: 0xA5, other invalid

0.1KM/H
Meter
A
Valid: 0xA5, other invalid

0.1AH
mV
0: Lifepo4, 1: Li-ion, 2: LTO
S
mV
mV
mV
mV
0.1V
0.1V
0.1V
0.1V
0.1A,30000 Offset
0.1A,30000 Offset
0.1A,30000 Offset
0.1A,30000 Offset
1°C,40 Offset
1°C,40 Offset
1°C,40 Offset
1°C,40 Offset
1°C,40 Offset
1°C,40 Offset
1°C,40 Offset
1°C,40 Offset
mV
mV
1°C
1°C
mV
mV
0 off or 1 on
0 off or 1 on
0.001
1°C, temperature data offset 40, for example, when temperature data is 40,
actual temperature = temperature data -40;

Year, month and day, such as August 15, 2020, send 0x14080F00

IP address such as 255.255.255.255:20096, the content sent is 0x32 : Followed by the


35 35 2E 32 35 35 2E 32 35 35 2E 32 35 35 3A 32 30 30 39 36 20 port number

You might also like