5.2 Modbus protocol

Version 16.3 by Admin on 2026/04/24 10:23

Communication protocols

Modbus protocol

General information

The BMS Main 2.x device provides the information about the battery system using Modbus protocol. The BMS is a Modbus-server and it responds to the Modbus-client’s commands.

Interaction with the device is performed over the RS-485 bus (Modbus RTU) or the Ethernet network (Modbus TCP).

RS-485 bus connection parameters:

  • baud rate, bps — 600, 1200, 2400, 4800, 9600 (by default), 19200, 38400, 57600, 115200;
  • word length, bits — 8;
  • parity — none;
  • device address (by default) — 32.

Ethernet connection parameters:

  • port — 502.

There is a description of the Input и Holding registers below. Column "Type" contains method of parameters coding:

  • U8 — unsigned 8-bit integer number;
  • U16 — unsigned 16-bit integer number;
  • S16 — signed 16-bit integer number;
  • U32 — unsigned 32-bit integer number;
  • REAL32 — single precision floating point number (IEEE 754 standard);
  • U8[x] — array of unsigned 8-bit integer numbers having a length of x;
  • U16[x] — array of unsigned 16-bit integer numbers having a length of x;
  • REAL32[x] — array of single precision floating point numbers having a length of x.

Words are in the little endian.

Input registers

Register addressNumber of registersContentType
0x00001

Hardware version:

byte 0 — minor;

byte 1 — major.

U8[2]
0x0001-0x00022

Firmware version:

byte 0 — patch;

byte 1 — minor;

byte 2 — major;

byte 3 — not used (set to 0).

U8[4]
0x0003-0x00042

Bootloader version:

byte 0 — patch;

byte 1 — minor;

byte 2 — major;

byte 3 — not used (set to 0).

U8[4]
0x1000-0x10033

Current time on the device clock:

byte 0 — day (BCD);

byte 1 — month (BCD);

byte 2 — year (BCD);

byte 3 — hours (BCD);

byte 4 — minutes (BCD);

byte 5 — seconds (BCD).

U8[6]
0x20001

Discrete input signals 1 (bitfield):

bit 0 — "Battery cover";

bit 1 — "Charger connected";

bit 2 — "Power up/down request";

bit 3 — "Inhibit charging";

bit 4 — "Inhibit discharging";

bit 5 — “Charging contactor feedback”;

bit 6 — “Discharging contactor feedback”;

bit 7 — “Insulation status”;

bit 8 – “Charge request”;

bit 9 – “Precharge request”;

bit 10 – “Discharge request”;

bit 11 – “PCH contactor feedback”;

bit 12 – “CH/DCH contactor feedback”;

bit 13 – “Main contactor feedback”;

bit 14 – “Interlock”;

bit 15 – “Fuse 1”.

U16
0x2001-0x20022Current measured by the primary sensor, АREAL32
0x2003-0x20042External temperature, °CREAL32
0x2005-0x20062Humidity, RH%REAL32
0x2007-0x20082

Errors 1 (bitfield):

bit 0 – “Overcurrent”;

bit 1 – “Undervoltage”;

bit 2 – “Overvoltage”;

bit 3 – “Low DCH temperature”, temperature is too low for discharging;

bit 4 – “High DCH temperature”, temperature is too high for discharging;

bit 5 – “Battery cover”;

bit 6 – “High humidity”;

bit 7 – “Water”;

bit 8 – “High logic temperature”, some BMS Logic device is overheated;

bit 9 – “Logic offline”, connection with some BMS Logic device is lost;

bit 10 – “Critical error”;

bit 11 – “Crown error”, connection with the Crown forklift is lost;

bit 12 – “Cell count error”, number of cells in incorrect;

bit 13 – “HYG offline”, connection with the HYG forklift is lost;

bit 14 – “Need acknowledgement”, errors were detected in the past and should be acknowledged;

bit 15 – “Combilift offline”, connection with the Combilift forklift is lost;

bit 16 – “Short circuit”;

bit 17 – “High contactor temperature”, the discharging contactor is overheated;

bit 18 – “Logic count error”, number of BMS Logic devices is incorrect;

bit 19 – “ADC error”, battery current cannot be measured by ADC;

bit 20 – “Current sensor error”, wires which connect the current sensor with the BMS are damaged;

bit 21 – “CH contactor cycles error”, the charging contactor switches very often;

bit 22 – “DCH contactor cycles error”, the discharging contactor switches very often;

bit 23 – “Shunt offline”, connection with the BMS Current sensor is lost;

bit 24 – “Shunt error”, internal error of the BMS Current sensor;

bit 25 – “Settings error”, checksum of the settings is incorrect;

bit 26 – “WDT reset”, device is reset by the watchdog timer;

bit 27 – “No temperature sensors”;

bit 28 – “Temperature sensor is shorted”;

bit 29 – “Spirit offline”, connection with the Spirit truck is lost;

bits 30–31 – reserved.

U32
0x2009-0x200A2

Internal signals (bitfield):

bit 0 — "Low SOC";

bit 1 — "High charging current";

bit 2 — “Charging” (0 – open, 1 – closed);

bit 3 — "Allow charging" (0 – open, 1 – closed);

bit 4 — "Charging current present";

bit 5 — “Discharging” (0 – open, 1 – closed);

bit 6 — "Discharging current present";

bit 7 — "Increased voltage" (EV);

bit 8 — "Heater" (0 – off, 1 – on);

bit 9 — "Cooler" (0 – off, 1 – on);

bit 10 — “HYG shutdown”, command from the HYG forklift to open the discharging contactor;

bit 11 — “Init”, initialization signal (during the initialization current sensor is calibrating and BMS Logic devices are scanning);

bit 12 — “Precharging” (0 – open, 1 – closed);

bit 13 — “Combilift shutdown”, command from the Combilift forklift to open the discharging contactor;

bit 14 — “Cell analysis”, signal of started analysis of the cells;

bit 15 — “Balancing series 1”;

bit 16 — “Balancing series 2”;

bit 17 — “Discharging (AUX)” (0 – open, 1 – closed);

bit 18 — “Acknowledgement of power down”;

bit 19 — “Crown EWS”;

bit 20 — “Main contactor” (0 – open, 1 - closed);

bit 21 – “Service reset”;

bit 22 – “Charging/Discharging” (0 – open, 1 – closed);

bit 23 – “Ready to charge” (the voltage of the cells is less than the threshold value and there are no errors that prohibit charging);

bit 24 – “Ready to discharge” (the voltage of the cells is greater than the threshold value and there are no errors that prohibit discharging);

bit 25 – “Power up”;

bit 26 — signal “External 1”;

bit 27 — signal “Heater (AUX)”;

bits 28-31 — not used.

U32
0x200B1

Discrete output signals (bitfield):

bit 0 — state of the output #1;

bit 1 — state of the output #2;

bit 2 — state of the output #3;

bit 3 — state of the output #4;

bits 4-15 — not used.

U16
0x200C1

Relay states (bitfield):

bit 0 — state of the relay #1;

bit 1 — state of the relay #2;

bit 2 — state of the relay #3;

bit 3 — state of the relay #4;

bits 4-15 — not used.

U16
0x200E-0x200F2

Errors 2 (bitfield):

bit 0 – "Low CH temperature", temperature is too low for charging;

bit 1 – “High CH temperature”, temperature is too high for charging;

bit 2 – “SD mount error”;

bit 3 – “SD read/write error”;

bit 4 – “Unallowable charging”, charging the battery through the discharging contactor;

bit 5 – “Stuck contactor”;

bit 6 – “CH contactor feedback error”;

bit 7 – “DCH contactor feedback error”;

bit 8 – “Insulation fault”;

bit 9 – “PCH contactor feedback error”;

bit 10 – “CH/DCH contactor feedback error”;

bit 11 – “Main contactor feedback error”;

bit 12 – reserved (set to 0);

bit 13 – “General error”;

bit 14 — reserved (set to 0);

bit 15 — reserved (set to 0);

bit 16 — reserved (set to 0);

bit 17 — “Precharge error”;

bits 18-31 — not used.

U32
0x20101Address or the BMS Logic device whose parameters are in registers 0x2011-0x20C9U16
0x20111

State of the BMS Logic (bitfield):

bit 0 — device is present;

bit 1 — device is online;

bit 2 — device is ready;

bit 3 — reserved;

bit 4 — temperature sensor #1 is present;

bit 5 — temperature sensor #2 is present;

bit 6 — temperature sensor #1 is shorted;

bit 7 — temperature sensor #2 is shorted;

bits 8-15 — reserved.

U16
0x2012-0x20132Temperature of the BMS Logic, °CREAL32
0x2014-0x20152

Cell balancing flags (bitfield):

bit i — balancing resistor is connected to the ith cell.

U32
0x2016-0x202920

Array of cells states. Each element of the array corresponds to a cell and is a bitfield:

bit 0 — cell is present;

bit 1 — temperature sensor is present;

bit 2 — need to connect a balancing resistor to the cell;

bit 3 — balancing resistor is connected to the cell;

bit 4 — temperature sensor is shorted;

bit 5 — wires are connected to the cell;

bits 6-15 — reserved.

U16[20]
0x202A-0x205140Array of cells voltages (V)REAL32[20]
0x2052-0x207940Array of cells temperatures (°C)REAL32[20]
0x207A-0x20A140Array of cells SOCs (%)REAL32[20]
0x20A2-0x20C940Array of cells resistances (Ohm)REAL32[20]
0x20F41

Discrete input signals 2 (bitfield):

bit 0 — “Fuse 2”;

bit 1 — “Fuse 3”;

bit 2 — “Circuit breaker status”;

bit 3 — signal "Balancing request";

bit 4 — signal "Close Main contactor";

bit 5 — signal "Close External 1";

bits 6-15 — not used.

U16
0x2100-0x21012Battery state of charge (SOC), %REAL32
0x21021Number of BMS Logic devicesU16
0x21031Number of cellsU16
0x2104-0x21052Battery voltage, VREAL32
0x2106-0x21072Battery resistance, OhmREAL32
0x2108-0x21092Effective capacity, A×hREAL32
0x210A-0x210B2Balancing effectivity, %REAL32
0x210C-0x210D2State of health, %REAL32
0x210E-0x210F2Depth of discharge, A×hREAL32
0x2110-0x21112Minimum BMS Logic temperatureREAL32
0x21121Address of the BMS Logic device whose temperature is minimalU16
0x2113-0x21142Maximum BMS Logic temperatureREAL32
0x21151Address of the BMS Logic device whose temperature is maximalU16
0x2116-0x21172BMS Logic polling rate, commands pre secondREAL32
0x2118-0x21192Minimum cell temperatureREAL32
0x211A1Address of the BMS Logic device which is connected to the cell whose temperature is minimalU16
0x211B1Position of the cell whose temperature is minimalU16
0x211C-0x211D2Maximum cell temperatureREAL32
0x211E1Address of the BMS Logic device which is connected to the cell whose temperature is maximalU16
0x211F1Position of the cell whose temperature is maximalU16
0x2120-0x21212Minimum cell voltageREAL32
0x21221Address of the BMS Logic device which is connected to the cell whose voltage is minimalU16
0x21231Position of the cell whose voltage is minimalU16
0x2124-0x21252Maximum cell voltageREAL32
0x21261Address of the BMS Logic device which is connected to the cell whose voltage is maximalU16
0x21271Position of the cell whose voltage is maximalU16
0x21281

Error flag:

0 — no errors;

1 — there are some errors.

U16
0x2130-0x21312Energy received from the charger, W×hREAL32
0x2132-0x21332Energy consumed by the load, W×hREAL32
0x2134-0x21352Energy dissipated by the balancing resistors, W×hREAL32
0x21401

SD-card mounting flag:

0 — not mounted;

1 — mounted.

U16
0x21411ReservedU16
0x21421ReservedU16
0x21701

Wi-Fi connection status:

0 — no connection;

1 — connection is established.

U16
0x2171-0x21722IP-address in the Wi-Fi networkU8[4]
0x2173-0x21753MAC-address of the Wi-Fi moduleU8[6]
0x2179-0x217A2Instant effective capacity, A×hREAL32
0x217B-0x217C2Coulomb received from the charger, A×hREAL32
0x217D-0x217E2Coulomb consumed by the load, A×hREAL32
0x217F-0x21802Ethernet IP-addressU8[4]
0x2181-0x21822Ethernet netmaskU8[4]
0x2183-0x21842Ethernet gatewayU8[4]
0x2185-0x21862Calibrated voltage in the reference line of the current sensor, VREAL32
0x218E-0x218F2Voltage from the current sensor, VREAL32
0x2190-0x21912Voltage in the reference line of the current sensor, VREAL32
0x2192-0x21932Voltage from the auxiliary current sensor, VREAL32
0x2194-0x21952Voltage in the reference line of the auxiliary current sensor, VREAL32
0x219F-0x21A02Charge current limit, AREAL32
0x21A1-0x21A22Discharge current limit, AREAL32
0x21B81Flag indicating that the cells are balancingU16
0x21C6-0x21C72Calibrated voltage in the reference line of the auxiliary current sensor, VREAL32
0x21CA-0x21CB2Average cell voltage, VREAL32
0x2200-0x22034

Record #1 from the errors journal. First 32-bit word contains a timestamp, second 32-bit word contains errors 1 flags (see 0x2007-0x2008).

Timestamp format:

bits 0-5 — year;

bits 6-9 — month;

bits 10-14 — day;

bits 15-19 — hours;

bits 20-25 — minutes;

bits 26-31 — seconds.

U32[2]
0x2204-0x22074Record #2 from the errors journalU32[2]
0x2208-0x227B Records #3-31 from the errors journal 
0x227C-0x227F4Record #32 from the errors journalU32[2]
0x23001Number of the last record from the errors journal (1..32)U16
0x2380-0x23834Record data #1 from the errors journal. First 32-bit word contains errors 2 flags (see 0x200E-0x200F).U32[2]
0x2384-0x23874Record data #2 from the errors journalU32[2]
0x2388-0x23FB Records data #3-31 from the errors journal 
0x23FC-0x23FF4Record data #32 from the errors journalU32[2]
0x2400-0x24012Current measured by the auxiliary current sensor, AREAL32
0x2402-0x24032

Final battery current, A

Note — Typically it is the sum of the values measured by the main and auxiliary current sensors

REAL32
0x24101

Battery state:

0 – Unknown;

1 – Charging ON;

2 – Charging OFF;

3 – Relaxed (after charging);

4 – Discharging ON;

5 – Discharging OFF;

6 – Relaxed (after discharging).

U16
0x2411-0x24122Duration of the battery state (0x2410), secondsU32
0x2420-0x24212Nominal battery capacity, A×hREAL32
0x2422-0x24232Maximum charge voltage, VREAL32
0x2424-0x24252Minimum discharge voltage, VREAL32
0x2426-0x24272Maximum charge current, AREAL32
0x2428-0x24292Maximum discharge current, AREAL32

Holding registers

Register addressNumber of registersContentType
0x40001Address of the BMS Logic device whose parameters should be in the input registers 0x2011-0x20C9U16
0x4100-0x41012

Command to acknowledge errors in the errors journal (bitfield). Each ith bit corresponds to (i+1) record.

Notes:

1 – After the errors are acknowledged, the register value will be set to 0.

2 – To acknowledge all errors, set 0xFFFFFFFF.

U32
0x51001

Software control of the "Battery cover" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Battery cover".

U16
0x51011

Software control of the "Charger connected" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Charger connected".

U16
0x51021

Software control of the "Power down request" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Power down request".

U16
0x51031

Software control of the "Inhibit charging" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Inhibit charging".

U16
0x51041

Software control of the "Inhibit discharging" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Inhibit discharging".

U16
0x51051

Software control of the "Charging contactor feedback" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Charging contactor feedback".

U16
0x51061

Software control of the "Discharging contactor feedback" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Discharging contactor feedback".

U16
0x51071

Software control of the "Insulation status" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Insulation status".

U16
0x51081

Software control of the "Charge request" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Charge request".

U16
0x51091

Software control of the "Precharge request" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Precharge request".

U16
0x510A1

Software control of the "Discharge request" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Discharge request".

U16
0x510B1

Software control of the "PCH contactor feedback" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "PCH contactor feedback".

U16
0x510C1

Software control of the "CH/DCH contactor feedback" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "CH/DCH contactor feedback".

U16
0x510D1

Software control of the "Main contactor feedback" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Main contactor feedback".

U16
0x510E1

Software control of the "Interlock" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Interlock".

U16
0x510F1

Software control of the "Fuse 1" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Fuse 1".

U16
0x51101

Software control of the "Fuse 2" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Fuse 2".

U16
0x51111

Software control of the "Fuse 3" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Fuse 3".

U16
0x51121

Software control of the "Circuit breaker status" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Circuit breaker status".

U16
0x51131

Software control of the "Balancing request" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Balancing request".

U16
0x51141

Software control of the "Close Main contactor" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Close Main contactor".

U16
0x51151

Software control of the "Close External 1" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Close External 1".

U16