6.2 Modbus protocol

Last modified by Admin on 2025/03/20 12:53

Communication protocols

Modbus protocol

General information

The BMS Main 3X device provides information about the battery system using Modbus protocol. The BMS is a Modbus-server and it responds to the Modbus-client’s commands.

Interaction with the device is performed over the RS-485 bus (Modbus RTU) or the Ethernet network (Modbus TCP).

The RS-485 bus connection parameters:

  • baud rate, bps — 600, 1200, 2400, 4800, 9600 (by default), 19200, 38400, 57600, 115200;
  • word length, bits — 8;
  • parity — none;
  • board address (by default) — 64.

There is a description of the Input и Holding registers below. Column "Type" contains method of parameters coding:

  • CHAR – character (signed 8-bit integer number);
  • U8 — unsigned 8-bit integer number;
  • U16 — unsigned 16-bit integer number;
  • S16 — signed 16-bit integer number;
  • U32 — unsigned 32-bit integer number;
  • REAL32 — single precision floating point number (IEEE 754 standard);
  • U8[x] — array of unsigned 8-bit integer numbers having a length of x;
  • U16[x] — array of unsigned 16-bit integer numbers having a length of x;
  • REAL32[x] — array of single precision floating point numbers having a length of x.

The bytes order of the word is little endian.

Input registers

Register addressNumber of registersContentType
0x00001

Hardware version:

byte 0 — minor;

byte 1 — major.

U8[2]
0x0001-0x00022

Firmware version:

byte 0 — patch;

byte 1 — minor;

byte 2 — major;

byte 3 — not used (set to 0).

U8[4]
0x0003-0x00042

Bootloader (ubl) version:

byte 0 — patch;

byte 1 — minor;

byte 2 — major;

byte 3 — not used (set to 0).

U8[4]
Battery state
0x10001Battery state of charge (SOC), %U16
0x10011Battery state of health (SOH), %U16
0x10021

Battery balancing efficiency, %

Note – The value is calculated as a minimal balancing efficiency among battery modules.

U16
0x10031

Battery state (enumeration):

0 – Off (the battery is off);

1 – Pre-balancing (the battery modules are precharging);

2 – Balancing (the battery modules are joined and balancing);

3 – Precharging (the modular battery is precharging);

4 – Idle (the modular battery is idle (charging and discharging currents are not detected));

5 – Charging (the modular battery is charging);

6 – Discharging (the modular battery is discharging).

U16
0x1004-0x10052Battery voltage, VREAL32
0x1006-0x10072Battery current, AREAL32
0x1008-0x10092Battery resistance, OhmREAL32
0x100A-0x100B2Temperature measured by external sensor 1, °CREAL32
0x100C-0x100D2Temperature measured by external sensor 2, °CREAL32
0x100E-0x100F2Minimum temperature among battery modules, °CREAL32
0x1010-0x10112Maximum temperature among battery modules, °CREAL32
0x1012-0x10132Battery capacity, A×hREAL32
0x1014-0x10152Energy received from the charger, W×hREAL32
0x1016-0x10172Energy consumed by the load, W×hREAL32
0x1018-0x10192Energy dissipated by the balancing resistors, W×hREAL32
0x101A-0x101B2Battery charge current limit, AREAL32
0x101C-0x101D2Battery discharge current limit, AREAL32
0x101E-0x101F2Duration of the battery state (0x1003), secondsU32
0x1020-0x10212

Internal signals (bitfield):

bit 0 – signal “Init” (current sensor calibration or battery modules scanning is performed);

bit 1 – signal “Charging” (0 – open, 1 – closed);

bit 2 – signal “Discharging” (0 – open, 1 – closed);

bit 3 – signal “Charging current present”;

bit 4 – signal “Discharging current present”;

bit 5 – signal “Charging/Discharging” (0 – open, 1 – closed);

bit 6 – signal “Precharging” (0 – open, 1 – closed);

bit 7 – signal “Interlock”;

bit 8 – signal “Fuse 1”;

bit 9 – signal “Fuse 2”;

bit 10 – signal “Fuse 3”;

bit 11 – signal “Heater” (0 – off, 1 – on);

bit 12 – signal “Cooler” (0 – off, 1 – on);

bit 13 – signal “Main contactor” (0 – open, 1 – closed);

bit 14 – signal “Service reset”;

bit 15 – signal “Coolant pump”;

bit 16 – signal “General error”;

bits 17-31 – not used.

U32
0x1022-0x10232

Common errors 1 (bitfield):

bit 0 – error “Battery cover”;

bit 1 – error “Modules offline”;

bit 2 – “Critical error”;

bit 3 – error “Voltage unbalance (CH)”;

bit 4 – error “Voltage unbalance (DCH)”;

bit 5 – error “Current unbalance (CH)”;

bit 6 – error “Current unbalance (DCH)”;

bit 7 – error “Charging current unbalance”;

bit 8 – error “Discharging current unbalance”;

bit 9 – reserved (set to 0);

bit 10 – “CH contactor feedback error”;

bit 11 – “DCH contactor feedback error”;

bit 12 – “CH/DCH contactor feedback error”;

bit 13 – “Insulation fault”;

bit 14 – error “WDT reset”;

bit 15 – error “Overcurrent”;

bit 16 – error “Power switch error”;

bit 17 – error “High humidity”;

bit 18 – error “Water”;

bit 19 – error “Short circuit”;

bit 20 – error “Contactor high temperature”;

bit 21 – error “Stuck contactor”;

bit 22 – “HVIL error”;

bit 23 – “ADC error”;

bit 24 – “Current sensor error”;

bit 25 – “Mount error”;

bit 26 – “FS error”;

bit 27 – “High voltage fault”;

bit 28 – “PCH contactor feedback error”;

bit 29 – “Main contactor feedback error”;

bit 30 – “Precharge error”;

bit 31 – “Current limit error”.

U32
0x1024-0x10252

Voltage unbalance CH errors (bitfield):

bit i – error of the (i+1)th battery module.

U32
0x1026-0x10272

Voltage unbalance DCH errors (bitfield).

Note – Registry mapping is the same as for registers 0x1024-0x1025

U32
0x1028-0x10292

Current unbalance CH errors (bitfield).

Note – Registry mapping is the same as for registers 0x1024-0x1025

U32
0x102A-0x102B2

Current unbalance DCH errors (bitfield).

Note – Registry mapping is the same as for registers 0x1024-0x1025

U32
0x102C-0x102D2

Charging current unbalance errors (bitfield).

Note – Registry mapping is the same as for registers 0x1024-0x1025

U32
0x102E-0x102F2

Discharging current unbalance errors (bitfield).

Note – Registry mapping is the same as for registers 0x1024-0x1025

U32
0x1030-0x10312

Cumulative internal signals (logical OR of all “Internal signals” values of the battery modules; bitfield):

bit 0 — signal "Low SOC";

bit 1 — signal "High charging current";

bit 2 — signal “Charging” (0 – open, 1 – closed);

bit 3 — signal "Allow charging" (0 – open, 1 – closed);

bit 4 — signal "Charging current present";

bit 5 — signal “Discharging” (0 – open, 1 – closed);

bit 6 — signal "Discharging current present";

bit 7 — signal "Voltage too high for charging";

bit 8 — signal "Heater" (0 – off, 1 – on);

bit 9 — signal "Cooler" (0 – off, 1 – on);

bit 10 — signal “Shutdown request (HYG/Spirit)”;

bit 11 — signal “Init” (current sensor calibration or BMS Logic scanning is performed);

bit 12 — signal “Precharging” (0 – open, 1 – closed);

bit 13 — signal “Shutdown request (Combilift)”;

bit 14 — signal "Cell analysis";

bit 15 — signal “Balancing 1”;

bit 16 — signal “Balancing 2”;

bit 17 — signal “Discharging (AUX)” (0 – open, 1 – closed);

bit 18 — signal “Power down ACK”;

bit 19 — signal “Crown EWS”;

bit 20 — signal “Main contactor” (0 – open, 1 – closed);

bit 21 — signal “Service reset”;

bit 22 — signal “Charging/Discharging” (0 – open, 1 – closed);

bit 23 — signal “Ready to charge”;

bit 24 — signal “Ready to discharge”;

bit 25 — signal “Power up”;

bits 26-31 — not used.

U32
0x1032-0x10332

Cumulative errors 1 (logical OR of all “Errors 1” values of the battery modules; bitfield):

bit 0 — error "Overcurrent";

bit 1 — error "Undervoltage";

bit 2 — error "Overvoltage";

bit 3 — error "Low temperature (DCH)";

bit 4 — error "High temperature (DCH)";

bit 5 — error "Battery cover";

bit 6 — error "High humidity";

bit 7 — error "Water";

bit 8 — error "Logic high temperature";

bit 9 — error "Logic offline";

bit 10 — "Critical error";

bit 11 — "Crown error";

bit 12 — "Cell count error";

bit 13 — error "HYG offline";

bit 14 — reserved (set to 0);

bit 15 — error "Combilift offline";

bit 16 — error "Short circuit";

bit 17 — error "High contactor temperature";

bit 18 — "Logic count error";

bit 19 — "ADC error";

bit 20 — “Current sensor error”;

bit 21 — “CH contactor cycles error”;

bit 22 — “DCH contactor cycles error”;

bit 23 — error "Shunt offline";

bit 24 — “Shunt error”;

bit 25 — reserved (set to 0);

bit 26 — error “WDT reset”;

bit 27 — error "No temperature sensors";

bit 28 — error "Temperature sensor shorted";

bit 29 — error “Spirit offline”;

bits 30-31 – not used.

U32
0x1034-0x1035 

Cumulative errors 2 (logical OR of all “Errors 2” values of the battery modules; bitfield):

bit 0 — error "Low temperature (CH)";

bit 1 — error “High temperature (CH)”;

bit 2 — reserved (set to 0);

bit 3 — reserved (set to 0);

bit 4 — error “Unallowable charging”;

bit 5 — error “Stuck contactor”;

bit 6 — “CH contactor feedback error”;

bit 7 — “DCH contactor feedback error”;

bit 8 — “Insulation fault”;

bit 9 — “PCH contactor feedback error”;

bit 10 — “CH/DCH contactor feedback error”;

bit 11 — “Main contactor feedback error”;

bit 12 — reserved (set to 0);

bit 13 — “General error”;

bit 14 — “High voltage fault”;

bit 15 — “Power switch error”;

bit 16 — “HVIL error”;

bit 17 — “Precharge error”;

bit 18 — “Power fault”;

bits 19-31 — not used.

U32
0x1036-0x10372

Remaining discharge time, seconds.

Note – The value 0xFFFFFFFF corresponds to the case when the device cannot calculate the remaining time.

U32
0x1038-0x10392

Common errors 2 (bitfield):

bit 0 – “Power fault”;

bits 1-31 – not used.

U32
0x103A-0x103B2

Discrete input signals (bitfield):

bit 0 – signal “Battery cover”;

bit 1 – signal “Charge request”;

bit 2 – signal “Precharge request”;

bit 3 – signal “Discharge request”;

bit 4 – signal “CH contactor feedback”;

bit 5 – signal “DCH contactor feedback”;

bit 6 – signal “CH/DCH contactor feedback”;

bit 7 – signal “Insulation status”;

bit 8 – signal “Join to charge”;

bit 9 – signal “Join to discharge;

bit 10 – signal “PCH contactor feedback”;

bit 11 – signal “Main contactor feedback”;

bit 12 – signal “Interlock”;

bit 13 – signal “Power down request”;

bits 14-31 – not used.

U32
Module #1 state: base address 0x2000

0x2000

(offset 0x0000)

1

Module state (enumeration):

0 – Unknown;

1 – Charging ON;

2 - Charging OFF;

3 – Relaxed (after charging);

4 – Discharging ON;

5 – Discharging OFF;

6 – Relaxed (after discharging).

U16

0x2001

(offset 0x0001)

1Module state of charge (SOC), %U16

0x2002

(offset 0x0002)

1Module state of health (SOH), %U16

0x2003

(offset 0x0003)

1Module balancing efficiency, %U16
0x2004-0x2008 (offset 0x0004)5

BMS firmware version.

Example: “1.59.1”

CHAR[10]

0x2009

(offset 0x0009)

1ReservedU16

0x200A-0x200B

(offset 0x000A)

2Module voltage, VREAL32

0x200C-0x200D

(offset 0x000C)

2Module current, АREAL32

0x200E-0x200F

(offset 0x000E)

2Module resistance, OhmREAL32

0x2010-0x2011

(offset 0x0010)

2Minimum cell temperatureREAL32

0x2012-0x2013

(offset 0x0012)

2Maximum cell temperatureREAL32

0x2014-0x2015

(offset 0x0014)

2Minimum cell voltageREAL32

0x2016-0x2017

(offset 0x0016)

2Maximum cell voltageREAL32

0x2018-0x2019

(offset 0x0018)

2Effective capacity, A×hREAL32

0x201A-0x201B

(offset 0x001A)

2Charge current limit, AREAL32

0x201C-0x201D

(offset 0x001C)

2Discharge current limit, AREAL32

0x201E-0x201F

(offset 0x001E)

2Energy received from the charger, W×hREAL32

0x2020-0x2021

(offset 0x0020)

2Energy consumed by the load, W×hREAL32

0x2022-0x2023

(offset 0x0022)

2Energy dissipated by the balancing resistors, W×hREAL32

0x2024-0x2025

(offset 0x0024)

2Number of 80% charge/discharge cyclesREAL32

0x2026-0x2027

(offset 0x0026)

2

Internal signals (bitfield).

Note – Registry mapping is the same as for 0x1030-0x1031.

U32

0x2028-0x2029

(offset 0x0028)

2

Errors 1 (bitfield).

Note – Registry mapping is the same as for 0x1032-0x1033.

U32

0x202A-0x202B

(offset 0x002A)

2

Errors 2 (bitfield).

Note – Registry mapping is the same as for 0x1034-0x1035.

U32

0x202C-0x202D

(offset 0x002C)

2

Discrete input signals (bitfield):

bit 0 — signal "Battery cover";

bit 1 — signal "Charger connected";

bit 2 — signal "Power up/down request";

bit 3 — signal "Inhibit charging";

bit 4 — signal "Inhibit discharging";

bit 5 — signal “CH contactor feedback”;

bit 6 — signal “DCH contactor feedback”;

bit 7 — signal “Insulation status”;

bit 8 – signal “Charge request”;

bit 9 – signal “Precharge request”;

bit 10 – signal “Discharge request”;

bit 11 – signal “PCH contactor feedback”;

bit 12 – signal “CH/DCH contactor feedback”;

bit 13 – signal “Main contactor feedback”;

bit 14 – signal “Interlock”;

bit 15 – signal “Fuse 1”;

bit 16 – signal “Fuse 2”;

bit 17 - signal “Fuse 3”;

bit 18 – signal “Circuit breaker status”;

bits 19-31 – reserved.

U32

0x202E-0x202F

(offset 0x002E)

2Module depth of discharge, A×hREAL32

Module #2 state: base address 0x2200

Registries have the same format as for Module #1

Module #3 state: base address 0x2400

Registries have the same format as for Module #1

Module #4 state: base address 0x2600

Registries have the same format as for Module #1

Module #5 state: base address 0x2800

Registries have the same format as for Module #1

Module #6 state: base address 0x2A00

Registries have the same format as for Module #1

Module #7 state: base address 0x2C00

Registries have the same format as for Module #1

Module #8 state: base address 0x2E00

Registries have the same format as for Module #1

Module #9 state: base address 0x3000

Registries have the same format as for Module #1

Module #10 state: base address 0x3200

Registries have the same format as for Module #1

Module #11 state: base address 0x3400

Registries have the same format as for Module #1

Module #12 state: base address 0x3600

Registries have the same format as for Module #1

Module #13 state: base address 0x3800

Registries have the same format as for Module #1

Module #14 state: base address 0x3A00

Registries have the same format as for Module #1

Module #15 state: base address 0x3C00

Registries have the same format as for Module #1

Module #16 state: base address 0x3E00

Registries have the same format as for Module #1

Module #17 state: base address 0x4000

Registries have the same format as for Module #1

Module #18 state: base address 0x4200

Registries have the same format as for Module #1

Module #19 state: base address 0x4400

Registries have the same format as for Module #1

Module #20 state: base address 0x4600

Registries have the same format as for Module #1

Module #21 state: base address 0x4800

Registries have the same format as for Module #1

Module #22 state: base address 0x4A00

Registries have the same format as for Module #1

Module #23 state: base address 0x4C00

Registries have the same format as for Module #1

Module #24 state: base address 0x4E00

Registries have the same format as for Module #1

Module #25 state: base address 0x5000

Registries have the same format as for Module #1

Module #26 state: base address 0x5200

Registries have the same format as for Module #1

Module #27 state: base address 0x5400

Registries have the same format as for Module #1

Module #28 state: base address 0x5600

Registries have the same format as for Module #1

Module #29 state: base address 0x5800

Registries have the same format as for Module #1

Module #30 state: base address 0x5A00

Registries have the same format as for Module #1

Module #31 state: base address 0x5C00

Registries have the same format as for Module #1

Module #32 state: base address 0x5E00

Registries have the same format as for Module #1

Holding registers

Register addressNumber of registersContentType
0x4100-0x41012

Command to acknowledge errors in the errors journal (bitfield). Each ith bit corresponds to (i+1) record.

Notes:

1 – After the errors are acknowledged, the register value will be set to 0.

2 – To acknowledge all errors, set 0xFFFFFFFF.

U32
0x50001

Software control of the "Battery cover" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Battery cover".

U16
0x50011

Software control of the "Charge request" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Charge request".

U16
0x50021

Software control of the "Precharge request" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Precharge request".

U16
0x50031

Software control of the "Discharge request" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Discharge request".

U16
0x50041

Software control of the "CH contactor feedback" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "CH contactor feedback".

U16
0x50051

Software control of the "DCH contactor feedback" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input “DCH contactor feedback".

U16
0x50061

Software control of the "CH/DCH contactor feedback" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "CH/DCH contactor feedback".

U16
0x50071

Software control of the "Insulation status" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Insulation status".

U16
0x50081

Software control of the "Join to charge" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Join to charge".

U16
0x50091

Software control of the "Join to discharge" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Join to discharge".

U16
0x500A1

Software control of the "PCH contactor feedback" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "PCH contactor feedback".

U16
0x500B1

Software control of the "Main contactor feedback" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Main contactor feedback".

U16
0x500C1

Software control of the "Interlock" signal. Allowable values:

0 – clear the signal;

1 – set the signal;

2-65535 – use the physical input "Interlock".

U16