en nl de en

Modbus RTU protocol

The protocol used by all power supplies is the Modbus protocol. This protocol provides a standard that the power supply uses for passing messages. During communication, the protocol determines how each power supply will know its device address, recognize a message addressed to it, determine the kind of action to be taken, and extract any data or other information in the message. The power supply will construct a reply message and send it using the Modbus protocol.

The protocol used complies to standard Modbus specification for slave nodes, using the binary format RTU mode (Remote Terminal Unit), with the following frame setup:

The software uses 2 functions of the Modbus protocol:

The Master can communicate to all Slaves at the same time using Address 0. This is called a broadcast-message. Slaves will carry out the send command, but they will not send any acknowledge message back to the Master.

FN3: Read Multiple Registers

FN3 function reads the binary contents of registers in the slave. The broadcast command is not supported. The query message specifies the starting register and quantity of registers to be read.

Here is an example of a request to read register 10 from slave device 1 (response = 100 decimal), the field examples are shown in hexadecimal:

Byte Field name Example
0 Slave address 01
1 Function 03
2 Starting register hi 00
3 Starting register lo 0A
4 Nr of registers hi 00
5 Nr of registers lo 01
6 CRC check lo A4
7 CRC check hi 08


Response:
The register data in the response message are packed as two bytes per register. For each register, the first byte contains the high order bits and the second contains the low order bits.

Byte Field name Example
0 Slave address 01
1 Function 03
2 Byte count 02
3 Data hi 00
4 Data lo 64
5 CRC check lo B9
6 CRC check hi AF

 

FN16: Preset Multiple Registers

FN16 command presets values into a sequence of registers. When a broadcast command is sent the function presets the same registers in all attached slaves.

Here is an example of a request to preset 3 registers starting at 31 to 103, 203 and 303 hex, in slave device 1. The field examples are shown in hexadecimal:

Byte Field name Example
0 Slave address 01
1 Function 10
2 Starting register hi 00
3 Starting register lo 1F
4 Nr of registers hi 00
5 Nr of registers lo 03
6 Byte count 06
7 Data hi 01
8 Data lo 03
9 Data hi 02
10 Data lo 03
11 Data hi 03
12 Data lo 03
13 CRC check lo 23
14 CRC check hi BD


Response:
The normal response returns the slave address, function code, starting register and quantity of registers to preset.

Byte Field name Example
0 Slave address 01
1 Function 10
2 Starting register hi 00
3 Starting register lo 1F
4 Nr of registers hi 00
5 Nr of registers lo 03
6 CRC check lo B1
7 CRC check hi CE

 

CRC Checking

The CRC field is two bytes, containing a 16-bit binary value. The CRC value is calculated by the transmitting device, which appends the CRC to the message. The receiving device recalculates a CRC during receipt of the message, and compares the calculated value to the actual value it received in the CRC field. If the two values are not equal an error will occur.

The CRC is started by first pre-loading a 16-bit register to all 1's. Then a process begins of applying successive eight-bit bytes of the message to the current contents of the register. Only the eight bits of data in each character are used for generating the CRC. Start and stop bits do not apply to the CRC.

During generation of the CRC, each eight-bit character is exclusive or-ed (exor) with the register contents. Then the result is shifted in the direction of the least significant bit (LSB), with a zero filled into the most significant bit (MSB) position. The LSB is extracted and examined.
If the LSB was a 1, the register is then exclusive or-ed (exor) with a preset, fixed value (= hex A001). If the LSB was a 0, no exclusive OR takes place.

This process is repeated until eight shifts have been performed. After the last (eighth) shift, the next eight-bit byte is exclusive or-ed with the register's current value, and the process repeats for eight more shifts as described above. The final contents of the register, after all the bytes of the message have been applied, is the CRC value.

When the CRC is appended to the message, the low-order byte is appended first, followed by the high-order byte.

Here is an example of a C language function performing CRC generation:

typedef unsigned int WORD;

char Buffer[128];

WORD CRC16(char Cnt)
/* ----------------------------------- */
/* Procedure to calculate CRC checksum */
/* ----------------------------------- */
{
  char c,i,j;
  WORD Temp = 0xFFFF;

  for (i=1;i<=Cnt;i++)
    {
    Temp ^= (WORD)Buffer[i];
    for (j=1;j<=8;j++)
      {
      c = (Temp & 0x0001);
      Temp = Temp >> 1;
      if (c) Temp ^= 0xA001;
      }
    }
  return Temp;
}

Exception Responses

Except for Broadcast-Messages, when a Master-Device sends a query to a Slave-Device it expects a normal response. One of four possible events can occur from the Master�s query:

  1. If the slave device receives the query without a communication error, and can handle the query normally, it returns a normal response
  2. If the slave does not receive the query due to a communication error, no response is returned. The master program will eventually process a timeout condition for the query.
  3. If the slave receives the query, but detects a communication error (like a CRC error), no response is returned. The master program will eventually process a timeout condition for the query.
  4. If the slave receives the query without a communication error, but cannot handle it (for example: if the request is to read a non-existent register), the slave will return an exception response informing the master of the nature of the error.

The exception response message has two fields that differentiate it from a normal response:

Function Code Field: In a normal response, the slave echoes the function code of the original query in the function field of the response. All function codes have a most-significant bit (MSB) of 0. In an exception response, the slave sets the MSB of the function code to 1. This makes the function code value in an exception response exactly 80 hexadecimal higher than the value would be for a normal response.

With the function code's MSB set, the master's application program can recognize the exception response and can examine the data field for the exception code.

Data Field: In a normal response, the slave may return data in the data field (any information red in the query). In an exception response, the slave returns an exception code in the data field. This defines the slave condition that caused the exception.

Here is a listing of exception codes used by the AxD software:

Code Name Meaning
01 ILLEGAL FUNCTION The function code received in the query is not an allowable action for the slave.
02 ILLEGAL DATA ADDRESS The data address received in the query is not an allowable address for the slave.
03 ILLEGAL DATA VALUE A value contained in the query data field is not an allowable value for the slave.


Example:

In the following example, the master requests register 1 from slave 1. Since register 1 is not read supported, an exception code 2 is returned:

Byte Field name Example
0 Slave address 01
1 Function 03
2 Starting register hi 00
3 Starting register lo 01
4 Nr of registers hi 00
5 Nr of registers lo 01
6 CRC check lo D5
7 CRC check hi CA


Response:

Byte Field name Example
0 Slave address 01
1 Function 83 (MSB bit is set)
2 Exception code 02 (illegal data address exception)
3 CRC check lo C0
4 CRC check hi F1