Skip to Content

6.2 Modbus protocol

Last modified by Admin on 2025/03/20 12:12

Communication protocols

Modbus protocol

General information

The BMS Main 3 device provides information about the battery system using Modbus protocol. The BMS is a Modbus-server and it responds to the Modbus-client’s commands.

Interaction with the device is performed over the RS-485 bus (Modbus RTU) or the Ethernet network (Modbus TCP).

The RS-485 bus connection parameters:

  • baud rate, bps — 600, 1200, 2400, 4800, 9600 (by default), 19200, 38400, 57600, 115200;
  • word length, bits — 8;
  • parity — none;
  • device address (by default) — 32.

Ethernet connection parameters:

  • port — 502.

There is a description of the Input и Holding registers below. Column "Type" contains method of parameter coding:

  • U8 — unsigned 8-bit integer number;
  • U16 — unsigned 16-bit integer number;
  • S16 — signed 16-bit integer number;
  • U32 — unsigned 32-bit integer number;
  • REAL32 — single precision floating point number (IEEE 754 standard);
  • U8[x] — array of unsigned 8-bit integer numbers having a length of x;
  • U16[x] — array of unsigned 16-bit integer numbers having a length of x;
  • REAL32[x] — array of single precision floating point numbers having a length of x.

The bytes order of the word is little endian.

Input registers

Register addressNumber of registersContentType
0x00001

Hardware version:

byte 0 — minor;

byte 1 — major.

U8[2]
0x0001-0x00022

Firmware version:

byte 0 — patch;

byte 1 — minor;

byte 2 — major;

byte 3 — not used (set to 0).

U8[4]
0x0003-0x00042

Bootloader (ubl) version:

byte 0 — patch;

byte 1 — minor;

byte 2 — major;

byte 3 — not used (set to 0).

U8[4]
0x20001

Discrete input signals 1 (bitfield):

bit 0 — signal "Battery cover";

bit 1 — signal "Charger connected";

bit 2 — signal "Power up/down request";

bit 3 — signal "Inhibit charging";

bit 4 — signal "Inhibit discharging";

bit 5 — signal “CH contactor feedback”;

bit 6 — signal “DCH contactor feedback”;

bit 7 — signal “Insulation status”;

bit 8 — signal “Charge request”;

bit 9 — signal “Precharge request”;

bit 10 — signal “Discharge request”;

bit 11 — signal “PCH contactor feedback”;

bit 12 — signal “CH/DCH contactor feedback”;

bit 13 — signal “Main contactor feedback”;

bit 14 — signal “Interlock”;

bit 15 — signal “Fuse 1”.

U16
0x2001-0x20022Current (sensor 1, high range), АREAL32
0x2003-0x20042Temperature (sensor 1), °CREAL32
0x2005-0x20062Humidity, RH%REAL32
0x2007-0x20082

Errors 1 (bitfield):

bit 0 — error "Overcurrent";

bit 1 — error "Undervoltage";

bit 2 — error "Overvoltage";

bit 3 — error "Low temperature (DCH)";

bit 4 — error "High temperature (DCH)";

bit 5 — error "Battery cover";

bit 6 — error "High humidity";

bit 7 — error "Water";

bit 8 — error "Logic high temperature";

bit 9 — error "Logic offline";

bit 10 — "Critical error";

bit 11 — "Crown error";

bit 12 — "Cell count error";

bit 13 — error "HYG offline";

bit 14 — reserved (set to 0);

bit 15 — error "Combilift offline";

bit 16 — error "Short circuit";

bit 17 — error "High contactor temperature";

bit 18 — "Logic count error";

bit 19 — "ADC error";

bit 20 — “Current sensor error”;

bit 21 — “CH contactor cycles error”;

bit 22 — “DCH contactor cycles error”;

bit 23 — error "Shunt offline";

bit 24 — “Shunt error”;

bit 25 — reserved (set to 0);

bit 26 — error “WDT reset”;

bit 27 — error "No temperature sensors";

bit 28 — error "Temperature sensor shorted";

bit 29 — error “Spirit offline”;

bits 30-31 – not used.

U32
0x2009-0x200A2

Internal signals (bitfield):

bit 0 — signal "Low SOC";

bit 1 — signal "High charging current";

bit 2 — signal “Charging” (0 – open, 1 – closed);

bit 3 — signal "Allow charging" (0 – open, 1 – closed);

bit 4 — signal "Charging current present";

bit 5 — signal “Discharging” (0 – open, 1 – closed);

bit 6 — signal "Discharging current present";

bit 7 — signal "Voltage too high for charging";

bit 8 — signal "Heater" (0 – off, 1 – on);

bit 9 — signal "Cooler" (0 – off, 1 – on);

bit 10 — signal “Shutdown request (HYG/Spirit)”;

bit 11 — signal “Init” (current sensor calibration or BMS Logic scanning is performed);

bit 12 — signal “Precharging” (0 – open, 1 – closed);

bit 13 — signal “Shutdown request (Combilift)”;

bit 14 — signal "Cell analysis";

bit 15 — signal “Balancing 1”;

bit 16 — signal “Balancing 2”;

bit 17 — signal “Discharging (AUX)” (0 – open, 1 – closed);

bit 18 — signal “Power down ACK”;

bit 19 — signal “Crown EWS”;

bit 20 — signal “Main contactor” (0 – open, 1 – closed);

bit 21 — signal “Service reset”;

bit 22 — signal “Charging/Discharging” (0 – open, 1 – closed);

bit 23 — signal “Ready to charge”;

bit 24 — signal “Ready to discharge”;

bit 25 — signal “Power up”;

bit 26 — signal “External 1”;

bits 27-31 — not used.

U32
0x200B1

Discrete output signals (bitfield):

bit 0 — state of the output 1;

bit 1 — state of the output 2;

bit 2 — state of the output 3;

bit 3 — state of the output 4;

bits 4-15 — not used.

U16
0x200C1

Power switch states (bitfield):

bit 0 — state of the power switch 1 (0 – open, 1 – closed);

bit 1 — state of the power switch 2 (0 – open, 1 – closed);

bit 2 — state of the power switch 3 (0 – open, 1 – closed);

bit 3 — state of the power switch 4 (0 – open, 1 – closed);

bit 4 — state of the power switch 5 (0 – open, 1 – closed);

bit 5 — state of the power switch 6 (0 – open, 1 – closed);

bits 6-15 — not used.

U16
0x200E-0x200F2

Errors 2 (bitfield):

bit 0 — error "Low temperature (CH)";

bit 1 — error “High temperature (CH)”;

bit 2 — reserved (set to 0);

bit 3 — reserved (set to 0);

bit 4 — error “Unallowable charging”;

bit 5 — error “Stuck contactor”;

bit 6 — “CH contactor feedback error”;

bit 7 — “DCH contactor feedback error”;

bit 8 — “Insulation fault”;

bit 9 — “PCH contactor feedback error”;

bit 10 — “CH/DCH contactor feedback error”;

bit 11 — “Main contactor feedback error”;

bit 12 — reserved (set to 0);

bit 13 — “General error”;

bit 14 — “High voltage fault”;

bit 15 — “Power switch error”;

bit 16 — “HVIL error”;

bit 17 — “Precharge error”;

bit 18 — “Power fault”;

bit 19 — “Current limit" error;

bits 20-31 — not used.

U32
0x20101Address of the BMS Logic device the parameters of which are in registers 0x2011-0x20C9U16
0x20111

BMS Logic state (bitfield):

bit 0 — device is present;

bit 1 — device is online;

bit 2 — device is ready;

bit 3 — data from the device is actual;

bit 4 — temperature sensor 1 is present;

bit 5 — temperature sensor 2 is present;

bit 6 — temperature sensor 1 is shorted;

bit 7 — temperature sensor 2 is shorted;

bits 8-15 — not used.

U16
0x2012-0x20132BMS Logic device temperature, °CREAL32
0x2014-0x20152

Cell balancing flags (bitfield):

bit i — balancing resistor is connected to the (i+1)th cell.

U32
0x2016-0x202920

Array of cell states. Each element of the array corresponds to a cell and is a bitfield:

bit 0 — cell is present;

bit 1 — temperature sensor is present;

bit 2 — need to connect a balancing resistor to the cell;

bit 3 — balancing resistor is connected to the cell;

bit 4 — temperature sensor is shorted;

bit 5 — wires are connected to the cell;

bits 6-15 — not used.

U16[20]
0x202A-0x205140Array of cell voltages (V)REAL32[20]
0x2052-0x207940Array of cell temperatures (°C)REAL32[20]
0x207A-0x20A140Array of cell SOCs (%)REAL32[20]
0x20A2-0x20C940Array of cell resistances (Ohm)REAL32[20]
0x20CA1

BMS Logic board version:

byte 0 – minor;

byte 1 – major.

U8[2]
0x20CB-0x20CC2

BMS Logic firmware version:

byte 0 – patch;

byte 1 – minor;

byte 2 – major;

byte 3 – not used (set to 0).

U8[4]
0x20CD1Number of cells BMS Logic can manageU16
0x20CE1BMS Logic serial numberU16
0x20F0-0x20F12Temperature (sensor 2), °CREAL32
0x20F2-0x20F32Device supply voltage, VREAL32
0x20F41

Discrete input signals 2 (bitfield):

bit 0 — signal "Fuse 2";

bit 1 — signal "Fuse 3";

bit 2 — signal "Circuit breaker status";

bit 3 — signal "Balancing request";

bit 4 — signal "Close Main contactor";

bit 5 — signal "Close External 1";

bits 6-15 — not used.

U16
0x2100-0x21012Battery state of charge (SOC), %REAL32
0x21021Number of connected BMS Logic devicesU16
0x21031Number of connected cellsU16
0x2104-0x21052Battery voltage, VREAL32
0x2106-0x21072Battery resistance, OhmREAL32
0x2108-0x21092Effective capacity, A×hREAL32
0x210A-0x210B2Balancing effectivity, %REAL32
0x210C-0x210D2State of health, %REAL32
0x210E-0x210F2Depth of discharge, A×hREAL32
0x2110-0x21112Minimum BMS Logic temperatureREAL32
0x21121Address of the BMS Logic device whose temperature is minimalU16
0x2113-0x21142Maximum BMS Logic temperatureREAL32
0x21151Address of the BMS Logic device whose temperature is maximalU16
0x2116-0x21172BMS Logic polling rate, commands pre secondREAL32
0x2118-0x21192Minimum cell temperatureREAL32
0x211A1Address of the BMS Logic device which is connected to the cell whose temperature is minimalU16
0x211B1Position of the cell whose temperature is minimalU16
0x211C-0x211D2Maximum cell temperatureREAL32
0x211E1Address of the BMS Logic device which is connected to the cell whose temperature is maximalU16
0x211F1Position of the cell whose temperature is maximalU16
0x2120-0x21212Minimum cell voltageREAL32
0x21221Address of the BMS Logic device which is connected to the cell whose voltage is minimalU16
0x21231Position of the cell whose voltage is minimalU16
0x2124-0x21252Maximum cell voltageREAL32
0x21261Address of the BMS Logic device which is connected to the cell whose voltage is maximalU16
0x21271Position of the cell whose voltage is maximalU16
0x21281

Error flag:

0 — no errors;

1 — there are some errors.

U16
0x2130-0x21312Energy received from the charger, W×hREAL32
0x2132-0x21332Energy consumed by the load, W×hREAL32
0x2134-0x21352Energy dissipated by the balancing resistors, W×hREAL32
0x217B-0x217C2Coulomb received from the charger, A×hREAL32
0x217D-0x217E2Coulomb consumed by the load, A×hREAL32
0x21B81Flag indicating that some cell is being balancedU16
0x21CA-0x21CB2Average cell voltage, VREAL32
0x2400-0x24012Current (sensor 1, low range), AREAL32

0x2402-0x2403

2Final battery current, AREAL32
0x24101

Battery state (enumeration):

0 – Unknown;

1 – Charging ON;

2 – Charging OFF;

3 – Relaxed (after charging);

4 – Discharging ON;

5 – Discharging OFF;

6 – Relaxed (after discharging).

U16
0x2411-0x24122Duration of the battery state (0x2410), secondsU32

Holding registers

Register addressNumber of registersContentType
0x40001Address of the BMS Logic device whose parameters should be in the input registers 0x2011-0x20C9U16
0x51001

Software control of the "Battery cover" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Battery cover".

U16
0x51011

Software control of the "Charger connected" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Charger connected".

U16
0x51021

Software control of the "Power up/down request" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Power down request".

U16
0x51031

Software control of the "Inhibit charging" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Inhibit charging".

U16
0x51041

Software control of the "Inhibit discharging" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Inhibit discharging".

U16
0x51051

Software control of the "CH contactor feedback" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Charging contactor feedback".

U16
0x51061

Software control of the "DCH contactor feedback" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Discharging contactor feedback".

U16
0x51071

Software control of the "Insulation status" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Insulation status".

U16
0x51081

Software control of the "Charge request" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Charge request".

U16
0x51091

Software control of the "Precharge request" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Precharge request".

U16
0x510A1

Software control of the "Discharge request" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Discharge request".

U16
0x510B1

Software control of the "PCH contactor feedback" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "PCH contactor feedback".

U16
0x510C1

Software control of the "CH/DCH contactor feedback" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "CH/DCH contactor feedback".

U16
0x510D1

Software control of the "Main contactor feedback" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Main contactor feedback".

U16
0x510E1

Software control of the "Interlock" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Interlock".

U16
0x510F1

Software control of the "Fuse 1" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Fuse 1".

U16
0x51101

Software control of the "Fuse 2" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Fuse 2".

U16
0x51111

Software control of the "Fuse 3" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Fuse 3".

U16
0x51121

Software control of the "Circuit breaker status" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Circuit breaker status".

U16
0x51131

Software control of the "Balancing request" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Balancing request".

U16
0x51141

Software control of the "Close Main contactor" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Close Main contactor".

U16
0x51151

Software control of the "Close External 1" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Close External 1".

U16