Skip to Content

Wiki source code of 4.2 Modbus protocol

Version 4.1 by Admin on 2024/11/29 14:04
Show last authors
1 == 4.2.1 General information ==
2
3 The BMS Main 2.x device provides the information about the battery system using Modbus protocol. The BMS is a Modbus-server and it responds to the Modbus-client’s commands.
4
5 Interaction with the device is performed over the RS-485 bus (Modbus RTU) or the Ethernet network (Modbus TCP).
6
7 RS-485 bus connection parameters:
8
9 * baud rate, bps — 600, 1200, 2400, 4800, 9600 (by default), 19200, 38400, 57600, 115200;
10 * word length, bits — 8;
11 * parity — none;
12 * device address (by default) — 32.
13
14 Ethernet connection parameters:
15
16 * port — 502.
17
18 There is a description of the Input и Holding registers below. Column "Type" contains method of parameters coding:
19
20 * U8 — unsigned 8-bit integer number;
21 * U16 — unsigned 16-bit integer number;
22 * S16 — signed 16-bit integer number;
23 * U32 — unsigned 32-bit integer number;
24 * REAL32 — single precision floating point number ([[IEEE 754>>url:https://ru.wikipedia.org/wiki/IEEE_754]] standard);
25 * U8[x] — array of unsigned 8-bit integer numbers having a length of x;
26 * U16[x] — array of unsigned 16-bit integer numbers having a length of x;
27 * REAL32[x] — array of single precision floating point numbers having a length of x.
28
29 Words are in the **little endian**.
30
31 == 4.2.2 Input registers ==
32
33 |**Register address**|**Number of registers**|**Content**|**Type**
34 |**0x0000**|1|(((
35 Hardware version:
36
37 byte 0 — minor;
38
39 byte 1 — major.
40 )))|U8[2]
41 |**0x0001-0x0002**|2|(((
42 Firmware version:
43
44 byte 0 — patch;
45
46 byte 1 — minor;
47
48 byte 2 — major;
49
50 byte 3 — not used (set to 0).
51 )))|U8[4]
52 |**0x0003-0x0004**|2|(((
53 Bootloader version:
54
55 byte 0 — patch;
56
57 byte 1 — minor;
58
59 byte 2 — major;
60
61 byte 3 — not used (set to 0).
62 )))|U8[4]
63 |**0x1000-0x1003**|3|(((
64 Current time on the device clock:
65
66 byte 0 — day (BCD);
67
68 byte 1 — month (BCD);
69
70 byte 2 — year (BCD);
71
72 byte 3 — hours (BCD);
73
74 byte 4 — minutes (BCD);
75
76 byte 5 — seconds (BCD).
77 )))|U8[6]
78 |**0x2000**|1|(((
79 Discrete input signals 1 (bitfield):
80
81 bit 0 — "Battery cover";
82
83 bit 1 — "Charger connected";
84
85 bit 2 — "Power up/down request";
86
87 bit 3 — "Inhibit charging";
88
89 bit 4 — "Inhibit discharging";
90
91 bit 5 — “Charging contactor feedback”;
92
93 bit 6 — “Discharging contactor feedback”;
94
95 bit 7 — “Insulation status”;
96
97 bit 8 – “Charge request”;
98
99 bit 9 – “Precharge request”;
100
101 bit 10 – “Discharge request”;
102
103 bit 11 – “PCH contactor feedback”;
104
105 bit 12 – “CH/DCH contactor feedback”;
106
107 bit 13 – “Main contactor feedback”;
108
109 bit 14 – “Interlock”;
110
111 bit 15 – “Fuse 1”.
112 )))|U16
113 |**0x2001-0x2002**|2|Current measured by the primary sensor, А|REAL32
114 |**0x2003-0x2004**|2|External temperature, °C|REAL32
115 |**0x2005-0x2006**|2|Humidity, RH%|REAL32
116 |**0x2007-0x2008**|2|(((
117 Errors 1 (bitfield):
118
119 bit 0 – “Overcurrent”;
120
121 bit 1 – “Undervoltage”;
122
123 bit 2 – “Overvoltage”;
124
125 bit 3 – “Low DCH temperature”, temperature is too low for discharging;
126
127 bit 4 – “High DCH temperature”, temperature is too high for discharging;
128
129 bit 5 – “Battery cover”;
130
131 bit 6 – “High humidity”;
132
133 bit 7 – “Water”;
134
135 bit 8 – “High logic temperature”, some BMS Logic device is overheated;
136
137 bit 9 – “Logic offline”, connection with some BMS Logic device is lost;
138
139 bit 10 – “Critical error”;
140
141 bit 11 – “Crown error”, connection with the Crown forklift is lost;
142
143 bit 12 – “Cell count error”, number of cells in incorrect;
144
145 bit 13 – “HYG offline”, connection with the HYG forklift is lost;
146
147 bit 14 – “Need acknowledgement”, errors were detected in the past and should be acknowledged;
148
149 bit 15 – “Combilift offline”, connection with the Combilift forklift is lost;
150
151 bit 16 – “Short circuit”;
152
153 bit 17 – “High contactor temperature”, the discharging contactor is overheated;
154
155 bit 18 – “Logic count error”, number of BMS Logic devices is incorrect;
156
157 bit 19 – “ADC error”, battery current cannot be measured by ADC;
158
159 bit 20 – “Current sensor error”, wires which connect the current sensor with the BMS are damaged;
160
161 bit 21 – “CH contactor cycles error”, the charging contactor switches very often;
162
163 bit 22 – “DCH contactor cycles error”, the discharging contactor switches very often;
164
165 bit 23 – “Shunt offline”, connection with the BMS Current sensor is lost;
166
167 bit 24 – “Shunt error”, internal error of the BMS Current sensor;
168
169 bit 25 – “Settings error”, checksum of the settings is incorrect;
170
171 bit 26 – “WDT reset”, device is reset by the watchdog timer;
172
173 bit 27 – “No temperature sensors”;
174
175 bit 28 – “Temperature sensor is shorted”;
176
177 bit 29 – “Spirit offline”, connection with the Spirit truck is lost;
178
179 bits 30–31 – reserved.
180 )))|U32
181 |**0x2009-0x200A**|2|(((
182 Internal signals (bitfield):
183
184 bit 0 — "Low SOC";
185
186 bit 1 — "High charging current";
187
188 bit 2 — “Charging” (0 – open, 1 – closed);
189
190 bit 3 — "Allow charging" (0 – open, 1 – closed);
191
192 bit 4 — "Charging current present";
193
194 bit 5 — “Discharging” (0 – open, 1 – closed);
195
196 bit 6 — "Discharging current present";
197
198 bit 7 — "Increased voltage" (EV);
199
200 bit 8 — "Heater" (0 – off, 1 – on);
201
202 bit 9 — "Cooler" (0 – off, 1 – on);
203
204 bit 10 — “HYG shutdown”, command from the HYG forklift to open the discharging contactor;
205
206 bit 11 — “Init”, initialization signal (during the initialization current sensor is calibrating and BMS Logic devices are scanning);
207
208 bit 12 — “Precharging” (0 – open, 1 – closed);
209
210 bit 13 — “Combilift shutdown”, command from the Combilift forklift to open the discharging contactor;
211
212 bit 14 — “Cell analysis”, signal of started analysis of the cells;
213
214 bit 15 — “Balancing series 1”;
215
216 bit 16 — “Balancing series 2”;
217
218 bit 17 — “Discharging (AUX)” (0 – open, 1 – closed);
219
220 bit 18 — “Acknowledgement of power down”;
221
222 bit 19 — “Crown EWS”;
223
224 bit 20 — “Main contactor” (0 – open, 1 - closed);
225
226 bit 21 – “Service reset”;
227
228 bit 22 – “Charging/Discharging” (0 – open, 1 – closed);
229
230 bit 23 – “Ready to charge” (the voltage of the cells is less than the threshold value and there are no errors that prohibit charging);
231
232 bit 24 – “Ready to discharge” (the voltage of the cells is greater than the threshold value and there are no errors that prohibit discharging);
233
234 bit 25 – “Power up”;
235
236 bits 26-31 – reserved.
237 )))|U32
238 |**0x200B**|1|(((
239 Discrete output signals (bitfield):
240
241 bit 0 — state of the output #1;
242
243 bit 1 — state of the output #2;
244
245 bit 2 — state of the output #3;
246
247 bit 3 — state of the output #4;
248
249 bits 4-15 — not used.
250 )))|U16
251 |**0x200C**|1|(((
252 Relay states (bitfield):
253
254 bit 0 — state of the relay #1;
255
256 bit 1 — state of the relay #2;
257
258 bit 2 — state of the relay #3;
259
260 bit 3 — state of the relay #4;
261
262 bits 4-15 — not used.
263 )))|U16
264 |**0x200E**|2|(((
265 Errors 2 (bitfield):
266
267 bit 0 – "Low CH temperature", temperature is too low for charging;
268
269 bit 1 – “High CH temperature”, temperature is too high for charging;
270
271 bit 2 – “SD mount error”;
272
273 bit 3 – “SD read/write error”;
274
275 bit 4 – “Unallowable charging”, charging the battery through the discharging contactor;
276
277 bit 5 – “Stuck contactor”;
278
279 bit 6 – “CH contactor feedback error”;
280
281 bit 7 – “DCH contactor feedback error”;
282
283 bit 8 – “Insulation fault”;
284
285 bit 9 – “PCH contactor feedback error”;
286
287 bit 10 – “CH/DCH contactor feedback error”;
288
289 bit 11 – “Main contactor feedback error”;
290
291 bit 12 – reserved (set to 0);
292
293 bit 13 – “General error”;
294
295 bits 14-31 — reserved.
296 )))|U32
297 |**0x2010**|1|Address or the BMS Logic device whose parameters are in registers 0x2011-0x20C9|U16
298 |**0x2011**|1|(((
299 State of the BMS Logic (bitfield):
300
301 bit 0 — device is present;
302
303 bit 1 — device is online;
304
305 bit 2 — device is ready;
306
307 bit 3 — data from the device is actual;
308
309 bit 4 — temperature sensor #1 is present;
310
311 bit 5 — temperature sensor #2 is present;
312
313 bit 6 — temperature sensor #1 is shorted;
314
315 bit 7 — temperature sensor #2 is shorted;
316
317 bits 8-15 — reserved.
318 )))|U16
319 |**0x2012-0x2013**|2|Temperature of the BMS Logic, °C|REAL32
320 |**0x2014-0x2015**|2|(((
321 Cell balancing flags (bitfield):
322
323 bit i — balancing resistor is connected to the i^^th^^ cell.
324 )))|U32
325 |**0x2016-0x2029**|20|(((
326 Array of cells states. Each element of the array corresponds to a cell and is a bitfield:
327
328 bit 0 — cell is present;
329
330 bit 1 — temperature sensor is present;
331
332 bit 2 — need to connect a balancing resistor to the cell;
333
334 bit 3 — balancing resistor is connected to the cell;
335
336 bit 4 — temperature sensor is shorted;
337
338 bit 5 — wires are connected to the cell;
339
340 bits 6-15 — reserved.
341 )))|U16[20]
342 |**0x202A-0x2051**|40|Array of cells voltages (V)|REAL32[20]
343 |**0x2052-0x2079**|40|Array of cells temperatures (°C)|REAL32[20]
344 |**0x207A-0x20A1**|40|Array of cells SOCs ~(%)|REAL32[20]
345 |**0x20A2-0x20C9**|40|Array of cells resistances (Ohm)|REAL32[20]
346 |**0x20F4**|1|(((
347 Discrete input signals 2 (bitfield):
348
349 bit 0 – “Fuse 2”;
350
351 bit 1 – “Fuse 3”;
352
353 bit 2 – “Circuit breaker status”;
354
355 bits 3-15 – reserved.
356 )))|U16
357 |**0x2100-0x2101**|2|Battery state of charge (SOC), %|REAL32
358 |**0x2102**|1|Number of BMS Logic devices|U16
359 |**0x2103**|1|Number of cells|U16
360 |**0x2104-0x2105**|2|Battery voltage, V|REAL32
361 |**0x2106-0x2107**|2|Battery resistance, Ohm|REAL32
362 |**0x2108-0x2109**|2|Effective capacity, A×h|REAL32
363 |**0x210A-0x210B**|2|Balancing effectivity, %|REAL32
364 |**0x210C-0x210D**|2|State of health, %|REAL32
365 |**0x210E-0x210F**|2|Depth of discharge, A×h|REAL32
366 |**0x2110-0x2111**|2|Minimum BMS Logic temperature|REAL32
367 |**0x2112**|1|Address of the BMS Logic device whose temperature is minimal|U16
368 |**0x2113-0x2114**|2|Maximum BMS Logic temperature|REAL32
369 |**0x2115**|1|Address of the BMS Logic device whose temperature is maximal|U16
370 |**0x2116-0x2117**|2|BMS Logic polling rate, commands pre second|REAL32
371 |**0x2118-0x2119**|2|Minimum cell temperature|REAL32
372 |**0x211A**|1|Address of the BMS Logic device which is connected to the cell whose temperature is minimal|U16
373 |**0x211B**|1|Position of the cell whose temperature is minimal|U16
374 |**0x211C-0x211D**|2|Maximum cell temperature|REAL32
375 |**0x211E**|1|Address of the BMS Logic device which is connected to the cell whose temperature is maximal|U16
376 |**0x211F**|1|Position of the cell whose temperature is maximal|U16
377 |**0x2120-0x2121**|2|Minimum cell voltage|REAL32
378 |**0x2122**|1|Address of the BMS Logic device which is connected to the cell whose voltage is minimal|U16
379 |**0x2123**|1|Position of the cell whose voltage is minimal|U16
380 |**0x2124-0x2125**|2|Maximum cell voltage|REAL32
381 |**0x2126**|1|Address of the BMS Logic device which is connected to the cell whose voltage is maximal|U16
382 |**0x2127**|1|Position of the cell whose voltage is maximal|U16
383 |**0x2128**|1|(((
384 Error flag:
385
386 0 — no errors;
387
388 1 — there are some errors.
389 )))|U16
390 |**0x2130-0x2131**|2|Energy received from the charger, W×h|REAL32
391 |**0x2132-0x2133**|2|Energy consumed by the load, W×h|REAL32
392 |**0x2134-0x2135**|2|Energy dissipated by the balancing resistors, W×h|REAL32
393 |**0x2140**|1|(((
394 SD-card mounting flag:
395
396 0 — not mounted;
397
398 1 — mounted.
399 )))|U16
400 |**0x2141**|1|Reserved|U16
401 |**0x2142**|1|Reserved|U16
402 |**0x2170**|1|(((
403 Wi-Fi connection status:
404
405 0 — no connection;
406
407 1 — connection is established.
408 )))|U16
409 |**0x2171-0x2172**|2|IP-address in the Wi-Fi network|U8[4]
410 |**0x2173-0x2175**|3|MAC-address of the Wi-Fi module|U8[6]
411 |**0x2179-0x217A**|2|Instant effective capacity, A×h|REAL32
412 |**0x217B-0x217C**|2|Coulomb received from the charger, A×h|REAL32
413 |**0x217D-0x217E**|2|Coulomb consumed by the load, A×h|REAL32
414 |**0x217F-0x2180**|2|Ethernet IP-address|U8[4]
415 |**0x2181-0x2182**|2|Ethernet netmask|U8[4]
416 |**0x2183-0x2184**|2|Ethernet gateway|U8[4]
417 |**0x2185-0x2186**|2|Calibrated voltage in the reference line of the current sensor, V|REAL32
418 |**0x218E**|2|Voltage from the current sensor, V|REAL32
419 |**0x2190**|2|Voltage in the reference line of the current sensor, V|REAL32
420 |**0x2192**|2|Voltage from the auxiliary current sensor, V|REAL32
421 |**0x2194**|2|Voltage in the reference line of the auxiliary current sensor, V|REAL32
422 |**0x219F**|2|Charge current limit, A|REAL32
423 |**0x21A1**|2|Discharge current limit, A|REAL32
424 |**0x21B8**|1|Flag indicating that the cells are balancing|U16
425 |**0x21C6**|2|Calibrated voltage in the reference line of the auxiliary current sensor, V|REAL32
426 |**0x21CA**|2|Average cell voltage, V|REAL32
427 |**0x2200-0x2203**|4|(((
428 Record #1 from the errors journal. First 32-bit word contains a timestamp, second 32-bit word contains errors 1 flags (see 0x2007-0x2008).
429
430 Timestamp format:
431
432 bits 0-5 — year;
433
434 bits 6-9 — month;
435
436 bits 10-14 — day;
437
438 bits 15-19 — hours;
439
440 bits 20-25 — minutes;
441
442 bits 26-31 — seconds.
443 )))|U32[2]
444 |**0x2204-0x2207**|4|Record #2 from the errors journal|U32[2]
445 |**0x2208-0x227B**| |Records #3-31 from the errors journal|
446 |**0x227C-0x227F**|4|Record #32 from the errors journal|U32[2]
447 |**0x2300**|1|Number of the last record from the errors journal (1..32)|U16
448 |**0x2380**|4|Record data #1 from the errors journal. First 32-bit word contains errors 2 flags (see 0x200E-0x200F).|U32[2]
449 |**0x2384-0x2387**|4|Record data #2 from the errors journal|U32[2]
450 |**0x2388-0x23FB**| |Records data #3-31 from the errors journal|
451 |**0x23FC-0x23FF**|4|Record data #32 from the errors journal|U32[2]
452 |**0x2400**|2|Current measured by the auxiliary current sensor, A|REAL32
453 |**0x2402**|2|(((
454 Final battery current, A
455
456 Note — Typically it is the sum of the values measured by the main and auxiliary current sensors
457 )))|REAL32
458 |**0x2410**|1|(((
459 Battery state:
460
461 0 – Unknown;
462
463 1 – Charging ON;
464
465 2 – Charging OFF;
466
467 3 – Relaxed (after charging);
468
469 4 – Discharging ON;
470
471 5 – Discharging OFF;
472
473 6 – Relaxed (after discharging).
474 )))|U16
475 |**0x2411**|2|Duration of the battery state (0x2410), seconds|U32
476 |**0x2420**|2|Nominal battery capacity, A×h|REAL32
477 |**0x2422**|2|Maximum charge voltage, V|REAL32
478 |**0x2424**|2|Minimum discharge voltage, V|REAL32
479 |**0x2426**|2|Maximum charge current, A|REAL32
480 |**0x2428**|2|Maximum discharge current, A|REAL32
481
482 == 4.2.3 Holding registers ==
483
484 |**Register address**|**Number of registers**|**Content**|**Type**
485 |**0x4000**|1|Address of the BMS Logic device whose parameters should be in the input registers 0x2011-0x20C9|U16
486 |**0x4100**|2|(((
487 Command to acknowledge errors in the errors journal (bitfield). Each //i//^^th^^ bit corresponds to (//i//+1) record.
488
489 Notes:
490
491 1 – After the errors are acknowledged, the register value will be set to 0.
492
493 2 – To acknowledge all errors, set 0xFFFFFFFF.
494 )))|U32
495 |**0x5100**|1|(((
496 Software control of the "Battery cover" signal. Allowable values:
497
498 0 – clear the signal;
499
500 1 – set the signal;
501
502 2-65535 – use the physical input "Battery cover".
503 )))|U16
504 |**0x5101**|1|(((
505 Software control of the "Charger connected" signal. Allowable values:
506
507 0 – clear the signal;
508
509 1 – set the signal;
510
511 2-65535 – use the physical input "Charger connected".
512 )))|U16
513 |**0x5102**|1|(((
514 Software control of the "Power down request" signal. Allowable values:
515
516 0 – clear the signal;
517
518 1 – set the signal;
519
520 2-65535 – use the physical input "Power down request".
521 )))|U16
522 |**0x5103**|1|(((
523 Software control of the "Inhibit charging" signal. Allowable values:
524
525 0 – clear the signal;
526
527 1 – set the signal;
528
529 2-65535 – use the physical input "Inhibit charging".
530 )))|U16
531 |**0x5104**|1|(((
532 Software control of the "Inhibit discharging" signal. Allowable values:
533
534 0 – clear the signal;
535
536 1 – set the signal;
537
538 2-65535 – use the physical input "Inhibit discharging".
539 )))|U16
540 |**0x5105**|1|(((
541 Software control of the "Charging contactor feedback" signal. Allowable values:
542
543 0 – clear the signal;
544
545 1 – set the signal;
546
547 2-65535 – use the physical input "Charging contactor feedback".
548 )))|U16
549 |**0x5106**|1|(((
550 Software control of the "Discharging contactor feedback" signal. Allowable values:
551
552 0 – clear the signal;
553
554 1 – set the signal;
555
556 2-65535 – use the physical input "Discharging contactor feedback".
557 )))|U16
558 |**0x5107**|1|(((
559 Software control of the "Insulation status" signal. Allowable values:
560
561 0 – clear the signal;
562
563 1 – set the signal;
564
565 2-65535 – use the physical input "Insulation status".
566 )))|U16
567 |**0x5108**|1|(((
568 Software control of the "Charge request" signal. Allowable values:
569
570 0 – clear the signal;
571
572 1 – set the signal;
573
574 2-65535 – use the physical input "Charge request".
575 )))|U16
576 |**0x5109**|1|(((
577 Software control of the "Precharge request" signal. Allowable values:
578
579 0 – clear the signal;
580
581 1 – set the signal;
582
583 2-65535 – use the physical input "Precharge request".
584 )))|U16
585 |**0x510A**|1|(((
586 Software control of the "Discharge request" signal. Allowable values:
587
588 0 – clear the signal;
589
590 1 – set the signal;
591
592 2-65535 – use the physical input "Discharge request".
593 )))|U16
594 |**0x510B**|1|(((
595 Software control of the "PCH contactor feedback" signal. Allowable values:
596
597 0 – clear the signal;
598
599 1 – set the signal;
600
601 2-65535 – use the physical input "PCH contactor feedback".
602 )))|U16
603 |**0x510C**|1|(((
604 Software control of the "CH/DCH contactor feedback" signal. Allowable values:
605
606 0 – clear the signal;
607
608 1 – set the signal;
609
610 2-65535 – use the physical input "CH/DCH contactor feedback".
611 )))|U16
612 |**0x510D**|1|(((
613 Software control of the "Main contactor feedback" signal. Allowable values:
614
615 0 – clear the signal;
616
617 1 – set the signal;
618
619 2-65535 – use the physical input "Main contactor feedback".
620 )))|U16
621 |**0x510E**|1|(((
622 Software control of the "Interlock" signal. Allowable values:
623
624 0 – clear the signal;
625
626 1 – set the signal;
627
628 2-65535 – use the physical input "Interlock".
629 )))|U16
630 |**0x510F**|1|(((
631 Software control of the "Fuse 1" signal. Allowable values:
632
633 0 – clear the signal;
634
635 1 – set the signal;
636
637 2-65535 – use the physical input "Fuse 1".
638 )))|U16
639 |**0x5110**|1|(((
640 Software control of the "Fuse 2" signal. Allowable values:
641
642 0 – clear the signal;
643
644 1 – set the signal;
645
646 2-65535 – use the physical input "Fuse 2".
647 )))|U16
648 |**0x5111**|1|(((
649 Software control of the "Fuse 3" signal. Allowable values:
650
651 0 – clear the signal;
652
653 1 – set the signal;
654
655 2-65535 – use the physical input "Fuse 3".
656 )))|U16