Modbus Communication Manual – 1st Edition

Table of Contents

Communication Data Frame ...................................................................................................1 Communication Parameters ................................................................................................1 Hardware Installation..............................................................................................................1 Data frame for RTU Mode......................................................................................................2 SLAVE Address..................................................................................................................2 Function Code.....................................................................................................................2 CRC CHECK ......................................................................................................................3 CRC calculation application program.............................................................................3 Command................................................................................................................................4 03H Read Register ..............................................................................................................4 06H Write single Register...................................................................................................4 08H LOOP BACK CHECK ...............................................................................................4 10H Write multipile Registers ............................................................................................5 Exception Codes .................................................................................................................7 Register Address .....................................................................................................................8 Limitation Notes ...............................................................................................................12 Note 1: Counter current value.......................................................................................12 Note 2: Counter Preset Value .......................................................................................12 Note 3: RTC Preset Value.............................................................................................12 Note 4: PWM Preset Value...........................................................................................13

Communication Data Frame SMT series intelligent relay can be controlled through communication with a PC (Loader Protocol) or by another controller (master) with the communication protocol, RTU Modbus.

Communication Parameters Transmission method Baud rate Stop bit Parity Maximum frame length

RS485 twisted pair 38400 2 None 64 bytes

Hardware Installation Maximum 99 stations Controller (PLC / HMI or PC) RS-485 Interface Response Request

Slave SMT Address 01H

Slave SMT Address 02H

Slave SMT Address 03H

Slave SMT Address 63H

Option Card A B

Option Card A B

Option Card A B

Option Card A B

120Ω 1/4w

120Ω 1/4w

Note: It is necessary to connect a terminal resistor with an impedance of 120Ω, 1/4W at both ends of the communication cable.

-1-

Data frame for RTU Mode The MASTER (PLC etc.) sends a request to the SLAVE, and a SLAVE responds to MASTER’s command. The signal receiving is illustrated here. The data length is varied with the command (Function).

** The interval should be maintained at 10ms between command signal and request.

SLAVE Address Function Code DATA CRC16 CHECK Signal Interval

SLAVE Address 00H : Broadcast to all the drivers 01H : to the No.01 Driver 0FH : to the No.15 Driver 10H : to the No.16 Driver and so on...., Max to No.99(63H)

Function Code 03H : Read the register contents 06H : Write a WORD to register 08H : Loop test 10H : Write several WORD’s to registers (complex number register write) CMS (Checksum and time-out definition)

-2-

1byte 1byte nbyte 2byte Signal Interval

CRC CHECK The CRC check code is taken from Slave Address to end of the data. The calculation method is illustrated as follow: (1) Load a 16-bit register with FFFF hex (all1’s). Call this the CRC register. (2) Exclusive OR the first 8-bit byte of the message with the low-order byte of the 16-bit CRC register, putting the result in the CRC register. (3) Shift the CRC register one bit to the right (toward the LSB), Zero-filling the MSB, Extract and examines the LSB. (4) (If the LSB was 0): Repeat Steps (3) (another shift) (If the LSB was 1): Exclusive OR the CRC register with the polynomial value A001 hex (1010 0000 0000 0001). (5) Repeat Steps (3) and (4) until 8 shifts been performed. When this is done, a complete 8bit byte will be processed. (6) Repeat Steps (2) through (5) for next 8-bit byte of the message, Continue doing this until all bytes have been processed. The final content of the CRC register is the CRC value. Placing the CRC into the message: When the 16-bit CRC (2 8-bit bytes) is transmitted in the message, the low-order byte will be transmitted first, followed by the high-order byte, For example, if the CRC value is 1241 hex, the CRC-16 (Low) put the 41h, the CRC-16 (Hi) put the 12h.

CRC calculation application program UWORD ch_sum ( UBYTE long , UBYTE *rxdbuff ) { BYTE i = 0; UWORD wkg = 0xFFFF; while ( long-- ) { wkg ^= rxdbuff++; for ( i = 0 ; i < 8; i++ ) { if ( wkg & 0x0001 ) { wkg = ( wkg >> 1 ) ^ 0xa001; } else { wkg = wkg >> 1; } } } return( wkg ); } TIME-OUT (400ms) & RETRY (max : 2 times) PC-LINK S PC-LINK PC-LINK

400ms S

400ms S

(When SMT time-out or detect checksum error, or SMT response error code = checksum error, PC-LINK retry maximum two times, and if two times after still error, then display “Communication error”)

-3-

Command 03H Read Register PC Æ PLC Address Function Code *Register (High) Address (Low) Data Length（Hi） Data Length（Lo） CRC-16 (Lo) CRC-16 (Hi)

PLCÆPC(OK) PLCÆPC(ERROR) 01H Address 01H 03H Function Code 03H 00H Data (byte) 26H 00H *Send out the data 00H CRC-16 (Lo) 13H

Address Function Code Exception Code CRC-16 (Lo) CRC-16 (Hi)

01H 83H 52H C0H CDH

CRC-16 (Hi)

04H 07H

06H Write single Register PC Æ PLC Address Function Code *Register (High) Address (Low) Write High Data Low CRC-16 (Lo) CRC-16 (Hi)

PLCÆPC(OK) PLCÆPC(ERROR) 01 H Address 01H 06H Function Code 06H 01H *Register High 01H Address Low 02H 02H 17H Write High 17H Data 70H Low 70H 27H CRC-16 (Lo) 27H E2H CRC-16 (Hi) E2H

SLAVE Address Function Code Exception Code CRC-16 (Lo) CRC-16 (Hi)

01H 86H 52H C3H 9DH

08H LOOP BACK CHECK The check code checking the transmission of the signal between MASTER and SLAVE could be discretionary. PC Æ PLC SLAVE Address Function Code Check High Code Low High DATA Low High CRC-16 Low

01 H 08H 00H 00H A5H 37H DAH 8DH

PLCÆPC(OK) SLAVE Address 01H Function Code 08H Check High 00H Code Low 00H High A5H DATA Low 37H High DAH CRC-16 Low 8DH

-4-

PLCÆPC(ERROR) SLAVE Address 01H Function Code 88H Exception Code 20H High 47H CRC-16 Low D8H

10H Write multipile Registers PC Æ PLC Address Function Code *Register (High) Address (Low) Data Length（Hi） Data Length（Lo） Byte counters Send out the data CRC-16 (Lo) CRC-16 (Hi)

01H 10H 00H 00H 00H 13H 26H

PLCÆPC(OK) Address Function Code *Register (High) Address (Low) Data Length（Hi） Data Length（Lo） CRC-16 (Lo) CRC-16 (Hi)

-5-

01H 10H 00H 00H 00H 13H 81H C4H

PLCÆPC(ERROR) 01H SLAVE Address 10H Function Code Exception Code CRC-16 (Lo) CRC-16 (Hi)

01H 90H 52H ACH 3DH

Register Address

Data Length

0000H 0001H 0002H 0003H

1 1 1 1

0004H

1

0005H 0006H 0007H 0008H 0009H 000AH

1 1 1 1 1 1

000BH

1

000CH

1

000DH

1

000EH

1

0010H

1

0011H

1

0012H

1

0013H

1

0014H

1

0015H

1

0016H

1

Usable Content Cmd F E D RF RE GF GE TF TE CF CE 03H 06H 10H

03H 06H 10H

03H 06H 10H (Only FBD)

C RD GD TD CD

B RC GC TC CC

A RB GB TB CB

9 RA GA TA CA

8 R9 G9 T9 C9

7 R8 G8 T8 C8

6 R7 G7 T7 C7

5 R6 G6 T6 C6

4 R5 G5 T5 C5

3 R4 G4 T4 C4

2 R3 G3 T3 C3

1 R2 G2 T2 C2

0 R1 G1 T1 C1

-

MF ME MD MC MB MA M9 M8 M7 M6 M5 M4 M3 M2 M1

XC Q8 W1 6 W3 2 W4 8 W6 4

XB Q7 NF HF W1 5

XA Q6 1 NE HE W1 4

X9 Q5 ND HD W1 3

IC Q4 YC NC HC W1 2

IB Q3 YB NB HB W1 1

IA Q2 YA NA HA

I9 Q1 Y9 N9 H9 P1

I8 X8 Y8 N8 H8 L8

I7 X7 Y7 N7 H7 L7

I6 X6 Y6 N6 H6 L6

I5 X5 Y5 N5 H5 L5

I4 X4 Y4 N4 H4 L4

I3 X3 Y3 N3 H3 L3

I1 X1 Y1 N1 H1 L1

W1 W9 W8 W7 W6 W5 W4 W3 W2 W1 0 W17 W33 W49

B1 B1 B1 B1 B1 B1 B1 B9 B8 B7 B6 B5 B4 B3 6 5 4 3 2 1 0 B3 2 B4 8 B6 4 B8 0 B9 6 -

I2 X2 Y2 N2 H2 L2

-

-

-

-

-6-

-

-

-

-

-

-

-

-

B2

B1 B17 B33 B49 B65 B81

B99 B98 B97

Exception Codes If an error has occurred during communication, the controller responds with an Exception Code and send the Function Code together with 80H to the main system. Error Codes 51 52 53 54 55 56 57 58 59

Description Frame error (Function Code error, Register Encoding error, Data Quantity Error) Run mode and command disable Secret mode and command disable Data value over rang SMT system ROM error SMT RTC not exist, can’t operate RTC SMT the other error Commands do not match SMT edit mode Brand ID error

-7-

Register Address (00xxH) Coil Status Address (01xxH) Control register Address Register Data Usable Content Address Length Comm. F 0100H

1

0101H

1

0102H

1

03H 06H 10H 03H

03H

RUN / STOP

MODE

E D C B A 9 8 7 6 5 4 - - - - - - - - - - S=0 STOP S= 1 RUN BRAND ID SMT MODE BRADE ID ：0～4 SMT MODE (Hex) Only C-Type model

STATUS A 1

-

I1 I0 L3 L2 L1 L0 -

-8-

S1 S2 B

3 -

2 -

1 -

0 S1

-

-

D1 D0

06H 10H

1

A： alarm at expand I/O No. unmatched ＝0： alarm ＝1： don’t alarm I1I0：expand I/O No.(0~3) L3 L2 L1 L0 =1 : English =2 : French =3 : Spanish =4 : Italian =5 : German =6 : Portugal =7 : Chinese B: Backlight on/off =0 ： auto on/off =1 ： always on s1:Power down retain(M coil) =1 : unretain =0 : retain S2:run/stop retain(Counter current value) =1 : retain =0 : unretain D1D0：Data communication mode =0： data link =1： remote I/O master =2： remote I/O slave

-

0103H

1

03H

0104H 1 0105H 1 0106H 1

03H 10H

-

-

-

-

-

-

S3 S2 S1 S0: 0 = OK 1 = ROM error STATUS 2 = RAM error 3 = EEPROM error 2 (PA,Error 4 = Program error 5 = Watchdog error ) 6 = Expand error 7 = Communication error PA： 0＝PASSWORD OFF 1 = PASSWORD ON Analog A1_GAIN_H config A1_OFFSET A2_GAIN_H -9-

PA -

-

-

A1_GAIN_L A2_GAN_L

-

S3 S2 S1 S0

0107H 0108H 0109H 010AH 010BH 0110H

1 1 1 1 1

A2_OFFSET A3_GAIN_H A3_OFFSET A4_GAIN_H A4_OFFSET Note: A_GAIN = (0~999) 06H 10H

1

CLEAR CODE

(02XXH) Current value Address Register Data Usable Comm. Address Length 0200H 1 0201H 1 03H 0202H 1 ……. …… 020EH 1 0210H 0211H …. 021EH

2 2 …. 2

0

0

0

0

0

0

0

A3_GAIN_L A4_GAN_L A_OFFSET = (-5-0~50) (complement) 0

0

0

0

Content Timer1 Timer2 Timer3 …….. TimerF

03H

03H 10H

RTC current value CURRENT_YEAR CURRENT_MOON CURRENT_DAY CURRENT_WEEK CURRENT_HOUR CURRENT_MINUTE CURRENT_SECOND 00

1 1 1 1

0230 0231 0232 0233 0234 0235 0236 0237

1 1 1 1 1 1 1 1

03H

3H

03H

*1

ANALOG 1 A1_VALUE_H A2_VALUE_H A3_VALUE_H A4_VALUE_H A5_VALUE_H A6_VALUE_H A7_VALUE_H A8_VALUE_H

A1_VALUE_L A2_VALUE_L A3_VALUE_L A4_VALUE_L A5_VALUE_L A6_VALUE_L A7_VALUE_L A8_VALUE_L

00 PW_H PT_H

PWM_RUN_NUM PW_L PT_L

PWM 0260H

- 10 -

0

Remark

CNT1 CNT2 …. CNTF

0220H 0021H 0022H 0023H

0

0

0

1

(03XXH) User character Address (Chinese lattice) Register Address 0300H 0301H …. 027H

Data Length 10H 10H …. 10H

Usable Comm. 03H 10H

Content

Remark

Character_5 Character_6 Character_44

(04XXH) Preset value Address Register Address TMR 0400H 0401H 0402H ……. 040EH COUNTER 0410H 0411H …. 041EH RTC 0420H 0421H … 042EH ANALOG 0430H 0431H …… 043EH PWM 0460H

Usable Comm.

Content

03H 10H

Timer1 Timer2 Timer3 …….. TimerF *2

03H 10H

CNT1 CNT2 …. CNTF

*3

03H 10H

RTC1 RTC2 …. RTCF

1H 1H ……. 1H

03H 10H

ANALOG 1 ANALOG 2 ……. ANALOG F

10H

03H 10H

PWM

Data Length 1H 1H 1H …… 1H 5H 5H …. 5H 3H 3H …. 3H

- 11 -

Remark

*4

Limitation Notes Note 1: Counter current value High bytes C_current_V_M 00 Counter value

Low bytes C_current_V_L C_current_V_H 0~999999

0~0F423FH (HEX)

Note 2: Counter Preset Value High bytes COUNTER MOD 1~7 C_PRESET_V_M 00 00

COUNTER MOD8

Counter value

00 00 FIX_TIM_H C_ON_PRESET_V_M 00 C_OFF_PRESET_V_M 00

0~999999

Low bytes C_PRESET_V_L C_PRESET_V_H 00 00 00 FIX_TIM_L C_ON_PRESET_V_L C_ON_PRESET_V_H C_OFF_PRESET_V_L C_OFF_PRESET_V_H

0~0F423FH (HEX)

Note 3: RTC Preset Value RTC MOD1 RTC MOD2 RTC MOD3

Year Months Days Weeks Hours Minutes Seconds

High bytes Turn on week Turn on time(hour) Turn off time(hour) Turn on year Turn on month Turn off month 00~99 01~12 01~31 00~06 00~23 00~59 00~59 - 12 -

Low bytes Turn off week Turn on time(min) Turn off time(min) Turn off year Turn on day Turn off day

Note 4: PWM Preset Value 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 PW PT

High bytes PW1_H PT1_H PW2_H PT2_H PW3_H PT3_H PW4_H PT4_H PW5_H PT5_H PW6_H PT6_H PW7_H PT7_H PW8_H PT8_H Pulse Width Value Period Value

Low bytes PW1_L PT1_L PW2_L PT2_L PW3_L PT3_L PW4_L PT4_L PW5_L PT5_L PW6_L PT6_L PW7_L PT7_L PW8_L PT8_L 00000~32767 00001~32767)

- 13 -