Modbus RTU protocol

The protocol used by all power supplies is the Modbus protocol. This protocol provides a standard that the power supply uses for passing messages. During communication, the protocol determines how each power supply will know its device address, recognize a message addressed to it, determine the kind of action to be taken, and extract any data or other information in the message. The power supply will construct a reply message and send it using the Modbus protocol.

The protocol used complies to standard Modbus specification for slave nodes, using the binary format RTU mode (Remote Terminal Unit), with the following frame setup:

a selectable baud rate
8 bit wide characters
no parity
1 stop bit

The software uses 2 functions of the Modbus protocol:

FN3: Read Multiple Registers
FN16: Preset Multiple Registers

The Master can communicate to all Slaves at the same time using Address 0. This is called a broadcast-message. Slaves will carry out the send command, but they will not send any acknowledge message back to the Master.

FN3: Read Multiple Registers

FN3 function reads the binary contents of registers in the slave. The broadcast command is not supported. The query message specifies the starting register and quantity of registers to be read.

Here is an example of a request to read register 10 from slave device 1 (response = 100 decimal), the field examples are shown in hexadecimal:

Byte	Field name	Example
0	Slave address	01
1	Function	03
2	Starting register hi	00
3	Starting register lo	0A
4	Nr of registers hi	00
5	Nr of registers lo	01
6	CRC check lo	A4
7	CRC check hi	08

Response:
The register data in the response message are packed as two bytes per register. For each register, the first byte contains the high order bits and the second contains the low order bits.

Byte	Field name	Example
0	Slave address	01
1	Function	03
2	Byte count	02
3	Data hi	00
4	Data lo	64
5	CRC check lo	B9
6	CRC check hi	AF

FN16: Preset Multiple Registers

FN16 command presets values into a sequence of registers. When a broadcast command is sent the function presets the same registers in all attached slaves.

Here is an example of a request to preset 3 registers starting at 31 to 103, 203 and 303 hex, in slave device 1. The field examples are shown in hexadecimal:

Byte	Field name	Example
0	Slave address	01
1	Function	10
2	Starting register hi	00
3	Starting register lo	1F
4	Nr of registers hi	00
5	Nr of registers lo	03
6	Byte count	06
7	Data hi	01
8	Data lo	03
9	Data hi	02
10	Data lo	03
11	Data hi	03
12	Data lo	03
13	CRC check lo	23
14	CRC check hi	BD

Response:
The normal response returns the slave address, function code, starting register and quantity of registers to preset.

Byte	Field name	Example
0	Slave address	01
1	Function	10
2	Starting register hi	00
3	Starting register lo	1F
4	Nr of registers hi	00
5	Nr of registers lo	03
6	CRC check lo	B1
7	CRC check hi	CE

CRC Checking

The CRC field is two bytes, containing a 16-bit binary value. The CRC value is calculated by the transmitting device, which appends the CRC to the message. The receiving device recalculates a CRC during receipt of the message, and compares the calculated value to the actual value it received in the CRC field. If the two values are not equal an error will occur.

The CRC is started by first pre-loading a 16-bit register to all 1's. Then a process begins of applying successive eight-bit bytes of the message to the current contents of the register. Only the eight bits of data in each character are used for generating the CRC. Start and stop bits do not apply to the CRC.

During generation of the CRC, each eight-bit character is exclusive or-ed (exor) with the register contents. Then the result is shifted in the direction of the least significant bit (LSB), with a zero filled into the most significant bit (MSB) position. The LSB is extracted and examined.
If the LSB was a 1, the register is then exclusive or-ed (exor) with a preset, fixed value (= hex A001). If the LSB was a 0, no exclusive OR takes place.

This process is repeated until eight shifts have been performed. After the last (eighth) shift, the next eight-bit byte is exclusive or-ed with the register's current value, and the process repeats for eight more shifts as described above. The final contents of the register, after all the bytes of the message have been applied, is the CRC value.

When the CRC is appended to the message, the low-order byte is appended first, followed by the high-order byte.

Here is an example of a C language function performing CRC generation:

typedef unsigned int WORD;

char Buffer[128];

WORD CRC16(char Cnt)
/* ----------------------------------- */
/* Procedure to calculate CRC checksum */
/* ----------------------------------- */
{
  char c,i,j;
  WORD Temp = 0xFFFF;

  for (i=1;i<=Cnt;i++)
    {
    Temp ^= (WORD)Buffer[i];
    for (j=1;j<=8;j++)
      {
      c = (Temp & 0x0001);
      Temp = Temp >> 1;
      if (c) Temp ^= 0xA001;
      }
    }
  return Temp;
}

Exception Responses

Except for Broadcast-Messages, when a Master-Device sends a query to a Slave-Device it expects a normal response. One of four possible events can occur from the Master�s query:

If the slave device receives the query without a communication error, and can handle the query normally, it returns a normal response
If the slave does not receive the query due to a communication error, no response is returned. The master program will eventually process a timeout condition for the query.
If the slave receives the query, but detects a communication error (like a CRC error), no response is returned. The master program will eventually process a timeout condition for the query.
If the slave receives the query without a communication error, but cannot handle it (for example: if the request is to read a non-existent register), the slave will return an exception response informing the master of the nature of the error.

The exception response message has two fields that differentiate it from a normal response:

Function Code Field: In a normal response, the slave echoes the function code of the original query in the function field of the response. All function codes have a most-significant bit (MSB) of 0. In an exception response, the slave sets the MSB of the function code to 1. This makes the function code value in an exception response exactly 80 hexadecimal higher than the value would be for a normal response.

With the function code's MSB set, the master's application program can recognize the exception response and can examine the data field for the exception code.

Data Field: In a normal response, the slave may return data in the data field (any information red in the query). In an exception response, the slave returns an exception code in the data field. This defines the slave condition that caused the exception.

Here is a listing of exception codes used by the AxD software:

Code	Name	Meaning
01	ILLEGAL FUNCTION	The function code received in the query is not an allowable action for the slave.
02	ILLEGAL DATA ADDRESS	The data address received in the query is not an allowable address for the slave.
03	ILLEGAL DATA VALUE	A value contained in the query data field is not an allowable value for the slave.

Example:

In the following example, the master requests register 1 from slave 1. Since register 1 is not read supported, an exception code 2 is returned:

Byte	Field name	Example
0	Slave address	01
1	Function	03
2	Starting register hi	00
3	Starting register lo	01
4	Nr of registers hi	00
5	Nr of registers lo	01
6	CRC check lo	D5
7	CRC check hi	CA

Response:

Byte	Field name	Example
0	Slave address	01
1	Function	83 (MSB bit is set)
2	Exception code	02 (illegal data address exception)
3	CRC check lo	C0
4	CRC check hi	F1