6.2 Modbus protocol

Version 2.1 by Admin on 2024/12/16 14:41

Communication protocols

Modbus protocol

General information

The BMS Main 3 device provides information about the battery system using Modbus protocol. The BMS is a Modbus-server and it responds to the Modbus-client’s commands.

Interaction with the device is performed over the RS-485 bus (Modbus RTU) or the Ethernet network (Modbus TCP).

The RS-485 bus connection parameters:

  • baud rate, bps — 600, 1200, 2400, 4800, 9600 (by default), 19200, 38400, 57600, 115200;
  • word length, bits — 8;
  • parity — none;
  • device address (by default) — 32.

Ethernet connection parameters:

  • port — 502.

There is a description of the Input и Holding registers below. Column "Type" contains method of parameter coding:

  • U8 — unsigned 8-bit integer number;
  • U16 — unsigned 16-bit integer number;
  • S16 — signed 16-bit integer number;
  • U32 — unsigned 32-bit integer number;
  • REAL32 — single precision floating point number (IEEE 754 standard);
  • U8[x] — array of unsigned 8-bit integer numbers having a length of x;
  • U16[x] — array of unsigned 16-bit integer numbers having a length of x;
  • REAL32[x] — array of single precision floating point numbers having a length of x.

The bytes order of the word is little endian.

Input registers

Register addressNumber of registersContentType
0x00001

Hardware version:

byte 0 — minor;

byte 1 — major.

U8[2]
0x0001-0x00022

Firmware version:

byte 0 — patch;

byte 1 — minor;

byte 2 — major;

byte 3 — not used (set to 0).

U8[4]
0x0003-0x00042

Bootloader version:

byte 0 — patch;

byte 1 — minor;

byte 2 — major;

byte 3 — not used (set to 0).

U8[4]
Battery state
0x10001Battery state of charge (SOC), %U16
0x10011

Battery state of health (SOH), %

Note – The value is calculated as a minimal SOH among battery modules.

U16
0x10021

Battery balancing efficiency, %

Note – The value is calculated as a minimal balancing efficiency among battery modules.

U16
0x10031

Battery state (enumeration):

0 – Off (battery is off);

1 – Pre-balancing (the battery modules are precharging);

2 – Balancing (the battery modules are joined and balancing);

3 – Precharging (the modular battery is precharging);

4 – Idle (the modular battery is idle (charging and discharging currents are not detected));

5 – Charging (the modular battery is charging);

6 – Discharging (the modular battery is discharging).

U16
0x1004-0x10052Battery voltage, VREAL32
0x1006-0x10072Battery current, AREAL32
0x1008-0x10092Battery resistance, OhmREAL32
0x100A-0x100B2Temperature measured by external sensor 1, °CREAL32
0x100C-0x100D2Temperature measured by external sensor 2, °CREAL32
0x100E-0x100F2Minimum cell temperature among all battery modules, °CREAL32
0x1010-0x10112Maximum cell temperature among all battery modules, °CREAL32
0x1012-0x10132Battery capacity, A×hREAL32
0x1014-0x10152Energy received from the charger, W×hREAL32
0x1016-0x10172Energy consumed by the load, W×hREAL32
0x1018-0x10192Energy dissipated by the balancing resistors, W×hREAL32
0x101A-0x101B2Battery charge current limit, AREAL32
0x101C-0x101D2Battery discharge current limit, AREAL32
0x101E-0x101F2Duration of the battery state (0x1003), secondsU32
0x1020-0x10212

Internal signals (bitfield):

bit 0 – signal “Init” (current sensor calibration or battery modules scanning is performed);

bit 1 – signal “Charging” (0 – open, 1 – closed);

bit 2 – signal “Discharging” (0 – open, 1 – closed);

bit 3 – signal “Charging current present”;

bit 4 – signal “Discharging current present”;

bit 5 – signal “Charging/Discharging” (0 – open, 1 – closed);

bit 6 – signal “Precharging” (0 – open, 1 – closed);

bit 7 – signal “Interlock”;

bit 8 – signal “Fuse 1”;

bit 9 – signal “Fuse 2”;

bit 10 – signal “Fuse 3”;

bit 11 – signal “Heater” (0 – off, 1 – on);

bit 12 – signal “Cooler” (0 – off, 1 – on);

bit 13 – signal “Main contactor” (0 – open, 1 – closed);

bits 14-29 – reserved (set to 0);

bit 30 – reserved (set to “1”);

bit 31 – no used.

U32
0x1022-0x10232

Common errors 1 (bitfield):

bit 0 – error “Battery cover”;

bit 1 – error “Modules offline”;

bit 2 – “Critical error”;

bit 3 – error “Voltage unbalance (CH)”;

bit 4 – error “Voltage unbalance (DCH)”;

bit 5 – error “Current unbalance (CH)”;

bit 6 – error “Current unbalance (DCH)”;

bit 7 – error “Charging current unbalance”;

bit 8 – error “Discharging current unbalance”;

bit 9 – reserved (set to 0);

bit 10 – “CH contactor feedback error”;

bit 11 – “DCH contactor feedback error”;

bit 12 – “CH/DCH contactor feedback error”;

bit 13 – “Insulation fault”;

bit 14 – error “WDT reset”;

bits 15-24 – reserved (set to 0);

bit 25 – “Mount error”;

bit 26 – “FS error”;

bit 27 – reserved (set to 0);

bit 28 – “PCH contactor feedback error”;

bit 29 – “Main contactor feedback error”;

bit 30 – “Precharge error”;

bit 31 – “Current limit error”.

U32
0x1024-0x10252

Voltage unbalance CH errors (bitfield):

bit i – error of the (i+1)th battery module.

U32
0x1026-0x10272

Voltage unbalance DCH errors (bitfield).

Note – Registry mapping is the same as for registers 0x1024-0x1025

U32
0x1028-0x10292

Current unbalance CH errors (bitfield).

Note – Registry mapping is the same as for registers 0x1024-0x1025

U32
0x102A-0x102B2

Current unbalance DCH errors (bitfield).

Note – Registry mapping is the same as for registers 0x1024-0x1025

U32
0x102C-0x102D2

Charging current unbalance errors (bitfield).

Note – Registry mapping is the same as for registers 0x1024-0x1025

U32
0x102E-0x102F2

Discharging current unbalance errors (bitfield).

Note – Registry mapping is the same as for registers 0x1024-0x1025

U32
0x1030-0x10312

Cumulative internal signals (logical OR of all “Internal signals” values of the battery modules; bitfield):

bit 0 — signal "Low SOC";

bit 1 — signal "High charging current";

bit 2 — signal “Charging” (0 – open, 1 – closed);

bit 3 — signal "Allow charging" (0 – open, 1 – closed);

bit 4 — signal "Charging current present";

bit 5 — signal “Discharging” (0 – open, 1 – closed);

bit 6 — signal "Discharging current present";

bit 7 — signal "Voltage too high for charging";

bit 8 — signal "Heater" (0 – off, 1 – on);

bit 9 — signal "Cooler" (0 – off, 1 – on);

bit 10 — signal “Shutdown request (HYG/Spirit)”;

bit 11 — signal “Init” (current sensor calibration or BMS Logic scanning is performed);

bit 12 — signal “Precharging” (0 – open, 1 – closed);

bit 13 — signal “Shutdown request (Combilift)”;

bit 14 — signal "Cell analysis";

bit 15 — signal “Balancing 1”;

bit 16 — signal “Balancing 2”;

bit 17 — signal “Discharging (AUX)” (0 – open, 1 – closed);

bit 18 — signal “Power down ACK”;

bit 19 — signal “Crown EWS”;

bit 20 — signal “Main contactor” (0 – open, 1 – closed);

bit 21 — signal “Service reset”;

bit 22 — signal “Charging/Discharging” (0 – open, 1 – closed);

bit 23 — signal “Ready to charge”;

bit 24 — signal “Ready to discharge”;

bit 25 — signal “Power up”;

bits 26-31 — not used.

U32
0x1032-0x10332

Cumulative errors 1 (logical OR of all “Errors 1” values of the battery modules; bitfield):

bit 0 — error "Overcurrent";

bit 1 — error "Undervoltage";

bit 2 — error "Overvoltage";

bit 3 — error "Low temperature (DCH)";

bit 4 — error "High temperature (DCH)";

bit 5 — error "Battery cover";

bit 6 — error "High humidity";

bit 7 — error "Water";

bit 8 — error "Logic high temperature";

bit 9 — error "Logic offline";

bit 10 — "Critical error";

bit 11 — "Crown error";

bit 12 — "Cell count error";

bit 13 — error "HYG offline";

bit 14 — reserved (set to 0);

bit 15 — error "Combilift offline";

bit 16 — error "Short circuit";

bit 17 — error "High contactor temperature";

bit 18 — "Logic count error";

bit 19 — "ADC error";

bit 20 — “Current sensor error”;

bit 21 — “CH contactor cycles error”;

bit 22 — “DCH contactor cycles error”;

bit 23 — error "Shunt offline";

bit 24 — “Shunt error”;

bit 25 — reserved (set to 0);

bit 26 — error “WDT reset”;

bit 27 — error "No temperature sensors";

bit 28 — error "Temperature sensor shorted";

bit 29 — error “Spirit offline”;

bits 30-31 – not used.

U32
0x1034-0x1035 

Cumulative errors 2 (logical OR of all “Errors 2” values of the battery modules; bitfield):

bit 0 — error "Low temperature (CH)";

bit 1 — error “High temperature (CH)”;

bit 2 — reserved (set to 0);

bit 3 — reserved (set to 0);

bit 4 — error “Unallowable charging”;

bit 5 — error “Stuck contactor”;

bit 6 — “CH contactor feedback error”;

bit 7 — “DCH contactor feedback error”;

bit 8 — “Insulation fault”;

bit 9 — “PCH contactor feedback error”;

bit 10 — “CH/DCH contactor feedback error”;

bit 11 — “Main contactor feedback error”;

bit 12 — reserved (set to 0);

bit 13 — “General error”;

bits 14-31 — not used.

U32
0x1036-0x10372

Remaining discharge time, second.

Note – The value 0xFFFFFFFF corresponds to the case when the device cannot calculate the remaining time.

U32
0x1038-0x10392

Common errors 2 (bitfield):

bits 0-31 – not used.

U32
0x103A-0x103B2

Discrete input signals (bitfield):

bit 0 – signal “Battery cover”;

bit 1 – signal “Charge request”;

bit 2 – signal “Precharge request”;

bit 3 – signal “Discharge request”;

bit 4 – signal “CH contactor feedback”;

bit 5 – signal “DCH contactor feedback”;

bit 6 – signal “CH/DCH contactor feedback”;

bit 7 – signal “Insulation status”;

bit 8 – signal “Join to charge”;

bit 9 – signal “Join to discharge;

bit 10 – signal “PCH contactor feedback”;

bit 11 – signal “Main contactor feedback”;

bits 12-31 – not used.

U32
0x103C-0x103D2

Flags indicating that the battery modules are enabled but not detected (bitfield):

bit i – the (i+1)th battery module is enabled but not detected.

U32
0x103E-0x103F2

Flags indicating that the battery modules are detected (bitfield):

bit i – the (i+1)th battery module is detected.

U32
0x1040-0x10412

Flags indicating that the battery modules are online (bitfield):

bit i – the (i+1)th battery module is online.

U32
0x1042-0x10432

Flags indicating that the battery modules are offline (bitfield):

bit i – the (i+1)th battery module is offline.

U32
0x10441Index of the battery module that has the cell with the minimum temperatureU16
0x10451Index of the Logic device that is connected to the cell with the minimum temperatureU16
0x10461Index of the cell that has the minimum temperatureU16
0x10471Index of the battery module that has the cell with the maximum temperatureU16
0x10481Index of the Logic device that is connected to the cell with the maximum temperatureU16
0x10491Index of the cell that has the maximum temperatureU16
0x104A-0x104B2Minimum cell voltage among all battery modules, VREAL32
0x104C1Index of the battery module that has the cell with the minimum voltageU16
0x104D1Index of the Logic device that is connected to the cell with the minimum voltageU16
0x104E1Index of the cell that has the minimum voltageU16
0x104F1ReservedU16
0x1050-0x10512Maximum cell voltage among all battery modules, VREAL32
0x10521Index of the battery module that has the cell with the maximum voltageU16
0x10531Index of the Logic device that is connected to the cell with the maximum voltageU16
0x10541Index of the cell that has the maximum voltageU16
0x10551ReservedU16
0x1056-0x10572Minimum battery module voltage, VREAL32
0x10581Index of the battery module that has the minimum voltageU16
0x10591ReservedU16
0x105A-0x105B2Maximum battery module voltage, VREAL32
0x105C1Index of the battery module that has the maximum voltageU16
0x105D1ReservedU16
Module #1 state: base address 0x2000

0x2000

(offset 0x0000)

1

Module state (enumeration):

0 – Unknown;

1 – Charging ON;

2 - Charging OFF;

3 – Relaxed (after charging);

4 – Discharging ON;

5 – Discharging OFF;

6 – Relaxed (after discharging).

U16

0x2001

(offset 0x0001)

1Module state of charge (SOC), %U16

0x2002

(offset 0x0002)

1Module state of health (SOH), %U16

0x2003

(offset 0x0003)

1Module balancing efficiency, %U16
0x2004-0x2008 (offset 0x0004)5

BMS firmware version.

Example: “1.59.1”

CHAR[10]

0x2009

(offset 0x2009)

1ReservedU16

0x200A-0x200B

(offset 0x000A)

2Module voltage, VREAL32

0x200C-0x200D

(offset 0x000C)

2Module current, АREAL32

0x200E-0x200F

(offset 0x000E)

2Module resistance, OhmREAL32

0x2010-0x2011

(offset 0x0010)

2Minimum cell temperatureREAL32

0x2012-0x2013

(offset 0x0012)

2Maximum cell temperatureREAL32

0x2014-0x2015

(offset 0x0014)

2Minimum cell voltageREAL32

0x2016-0x2017

(offset 0x0016)

2Maximum cell voltageREAL32

0x2018-0x2019

(offset 0x0018)

2Effective capacity, A×hREAL32

0x201A-0x201B

(offset 0x001A)

2Charge current limit, AREAL32

0x201C-0x201D

(offset 0x001C)

2Discharge current limit, AREAL32

0x201E-0x201F

(offset 0x001E)

2Energy received from the charger, W×hREAL32

0x2020-0x2021

(offset 0x0020)

2Energy consumed by the load, W×hREAL32

0x2022-0x2023

(offset 0x0022)

2Energy dissipated by the balancing resistors, W×hREAL32

0x2024-0x2025

(offset 0x0024)

2Number of 80% charge/discharge cyclesREAL32

0x2026-0x2027

(offset 0x0026)

2

Internal signals (bitfield).

Note – Registry mapping is the same as for 0x1030-0x1031.

U32

0x2028-0x2029

(offset 0x0028)

2

Errors 1 (bitfield).

Note – Registry mapping is the same as for 0x1032-0x1033.

U32

0x202A-0x202B

(offset 0x002A)

2

Errors 2 (bitfield).

Note – Registry mapping is the same as for 0x1034-0x1035.

U32

0x202C-0x202D

(offset 0x002C)

2

Discrete input signals (bitfield):

bit 0 — signal "Battery cover";

bit 1 — signal "Charger connected";

bit 2 — signal "Power up/down request";

bit 3 — signal "Inhibit charging";

bit 4 — signal "Inhibit discharging";

bit 5 — signal “CH contactor feedback”;

bit 6 — signal “DCH contactor feedback”;

bit 7 — signal “Insulation status”;

bit 8 – signal “Charge request”;

bit 9 – signal “Precharge request”;

bit 10 – signal “Discharge request”;

bit 11 – signal “PCH contactor feedback”;

bit 12 – signal “CH/DCH contactor feedback”;

bit 13 – signal “Main contactor feedback”;

bit 14 – signal “Interlock”;

bit 15 – signal “Fuse 1”;

bit 16 – signal “Fuse 2”;

bit 17 - signal “Fuse 3”;

bit 18 – signal “Circuit breaker status”;

bits 19-31 – not used.

U32

0x202E-0x202F

(offset 0x002E)

2Module depth of discharge, A×hREAL32
0x2030
(offset 0x0030)
1Index of the Logic device that is connected to the cell with the minimum temperatureU16
0x2031
(offset 0x0031)
1Index of the cell that has the minimum temperatureU16
0x2032
(offset 0x0032)
1Index of the Logic device that is connected to the cell with the maximum temperatureU16
0x2033
(offset 0x0033)
1Index of the cell that has the maximum temperatureU16
0x2034
(offset 0x0034)
1Index of the Logic device that is connected to the cell with the minimum voltageU16
0x2035
(offset 0x0035)
1Index of the cell that has the minimum voltageU16
0x2036
(offset 0x0036)
1Index of the Logic device that is connected to the cell with the maximum voltageU16
0x2037
(offset 0x0037)
1Index of the cell that has the maximum voltageU16

Module #2 state: base address 0x2200

Note – Registries have the same format as for Module #1

Module #3 state: base address 0x2400

Note – Registries have the same format as for Module #1

Module #4 state: base address 0x2600

Note – Registries have the same format as for Module #1

Module #5 state: base address 0x2800

Note – Registries have the same format as for Module #1

Module #6 state: base address 0x2A00

Note – Registries have the same format as for Module #1

Module #7 state: base address 0x2C00

Note – Registries have the same format as for Module #1

Module #8 state: base address 0x2E00

Note – Registries have the same format as for Module #1

Module #9 state: base address 0x3000

Note – Registries have the same format as for Module #1

Module #10 state: base address 0x3200

Note – Registries have the same format as for Module #1

Module #11 state: base address 0x3400

Note – Registries have the same format as for Module #1

Module #12 state: base address 0x3600

Note – Registries have the same format as for Module #1

Module #13 state: base address 0x3800

Note – Registries have the same format as for Module #1

Module #14 state: base address 0x3A00

Note – Registries have the same format as for Module #1

Module #15 state: base address 0x3C00

Note – Registries have the same format as for Module #1

Module #16 state: base address 0x3E00

Note – Registries have the same format as for Module #1

Module #17 state: base address 0x4000

Note – Registries have the same format as for Module #1

Module #18 state: base address 0x4200

Note – Registries have the same format as for Module #1

Module #19 state: base address 0x4400

Note – Registries have the same format as for Module #1

Module #20 state: base address 0x4600

Note – Registries have the same format as for Module #1

Module #21 state: base address 0x4800

Note – Registries have the same format as for Module #1

Module #22 state: base address 0x4A00

Note – Registries have the same format as for Module #1

Module #23 state: base address 0x4C00

Note – Registries have the same format as for Module #1

Module #24 state: base address 0x4E00

Note – Registries have the same format as for Module #1

Module #25 state: base address 0x5000

Note – Registries have the same format as for Module #1

Module #26 state: base address 0x5200

Note – Registries have the same format as for Module #1

Module #27 state: base address 0x5400

Note – Registries have the same format as for Module #1

Module #28 state: base address 0x5600

Note – Registries have the same format as for Module #1

Module #29 state: base address 0x5800

Note – Registries have the same format as for Module #1

Module #30 state: base address 0x5A00

Note – Registries have the same format as for Module #1

Module #31 state: base address 0x5C00

Note – Registries have the same format as for Module #1

Module #32 state: base address 0x5E00

Note – Registries have the same format as for Module #1

Holding registers

Register addressNumber of registersContentType
0x40001Address of the BMS Logic device whose parameters should be in the input registers 0x2011-0x20C9U16
0x51001

Software control of the "Battery cover" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Battery cover".

U16
0x51011

Software control of the "Charger connected" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Charger connected".

U16
0x51021

Software control of the "Power up/down request" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Power down request".

U16
0x51031

Software control of the "Inhibit charging" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Inhibit charging".

U16
0x51041

Software control of the "Inhibit discharging" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Inhibit discharging".

U16
0x51051

Software control of the "CH contactor feedback" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Charging contactor feedback".

U16
0x51061

Software control of the "DCH contactor feedback" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Discharging contactor feedback".

U16
0x51071

Software control of the "Insulation status" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Insulation status".

U16
0x51081

Software control of the "Charge request" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Charge request".

U16
0x51091

Software control of the "Precharge request" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Precharge request".

U16
0x510A1

Software control of the "Discharge request" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Discharge request".

U16
0x510B1

Software control of the "PCH contactor feedback" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "PCH contactor feedback".

U16
0x510C1

Software control of the "CH/DCH contactor feedback" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "CH/DCH contactor feedback".

U16
0x510D1

Software control of the "Main contactor feedback" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Main contactor feedback".

U16
0x510E1

Software control of the "Interlock" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Interlock".

U16
0x510F1

Software control of the "Fuse 1" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Fuse 1".

U16
0x51101

Software control of the "Fuse 2" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Fuse 2".

U16
0x51111

Software control of the "Fuse 3" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Fuse 3".

U16
0x51121

Software control of the "Circuit breaker status" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Circuit breaker status".

 
0x51131

Software control of the "Balancing request" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Balancing request".

 
0x51141

Software control of the "Close Main contactor" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Close Main contactor".