HAT600 ATS Controller

Communication Protocol

CONTENTS
1 MODBUS BASIC RULES .....................................................................................2 
2 DATA FRAME FORMAT ........................................................................................2 
3 COMMUNICATION PROTOCOL ..........................................................................2 
4 CRC-16 ALGORITHM PROCEDURE ...................................................................3 
5 EXAMPLES OF INFORMATION FRAME FORMAT..............................................4 
5.1 Function Code 01H ......................................................................................4 
5.2 Function Code 03H ......................................................................................4 
5.3 Function Code 05H ......................................................................................5 
6 ERROR HANDLING .............................................................................................6 
7 APPEDIX: ADDRESS AND DATA .........................................................................6 
7.1 Table 1: Function Code 01H Map Data Field ...............................................6 
7.2 Table 2: Function Code 03H Mapping Data Field ........................................8 
7.3 Table 3: Function Code 05H Mapping Data Field ........................................8 
1 MODBUS BASIC RULES
 All RS485 should follow the master-slave mode. If so, data can be
transferred between a master (e.g. PC) and 32 slaves.
 No communication can start from slaves.
 In RS485 communication, all communication should be transmitted in
“information frame”.
 If received information frame contains unknown command, no response
will be given.

2 DATA FRAME FORMAT

Communication is asynchronously transferred, using byte (data frame) as
unit. Between master and slave, every transmitted data frame is 10-bit serial
data stream.
Data frame format:
Start bit 1 bit
Data bits 8 bit
Parity bit No parity
Stop bit 1 bit
Baud rate 9600bps

3 COMMUNICATION PROTOCOL
When communication command is sent to the slave, corresponding slave
receives the communication command, then removes address code, and read
the information. If no mistakes, it will execute commands and sends the result
back to the master. Response information includes address code, function
code, data and error check code (CRC). If transmission error occurs, it will not
send any information.
 Information Frame Format
Initiating Address Function Data End
CRC
structure code code field structure
Delay Delay
1 byte 1 byte N byte 2 bytes
(equivalent to (equivalent
8-bit 8-bit N*8-bit 16-bit
4 bytes) to 4 bytes)
 Address Code
Address code is the first data byte in each transmitted information frame (8-bit)
limited to the range of 1–254.
 Function Code
This is a second byte of each transmission. If the MSB of function code sent by
slave is 1 (function code range>127), it means there is no response or
response has error.
The following table shows the specific signification and operation of function
code.
Function code Definition Operation
01H Read Coils Read Coils
03H Read registers Read Holding Registers.
05H Write Single Coil Write Single Coil.
1) 01H Read Coils
With function code 01H command, master can read types of coils.
2) 03H Read Holding Registers
With function code 03H command, the master can read the numerical registers
inside the module. Read registers values from the device are 2 bytes (16-bit).
The slave received command format is slave address, function code, data field
and CRC code. The data of data field is in double bytes with every two bytes
for a group, and high byte is in advance.
3) 05H Write Single Coil
Master uses this command to save a single coil data into bit registers in the
device.
 DATA Field
Data field varies with different function codes.
 Error Check Code (CRC)
The Error Check Field consists of a 16 bit Cyclical Redundancy Check
(CRC16). The CRC is 2 bytes. When the CRC is appended to the message,
the low-order byte is appended first, followed by the high-order byte.

4 CRC-16 ALGORITHM PROCEDURE

1) Firstly, load the 16-bit CRC register with the value FFFF hex.
2) Exclusive OR the 8-bit CRC register with the first data byte of the packet
and store the result in the 8-bit CRC register.
3) If the Least Significant Bit (LSB) of the 16-bit CRC register is equal to 1,
then shift the 16-bit CRC register to the right by one bit and then Exclusive
OR the result with the value A001 hex. Otherwise, just shift the 16-bit CRC
register to the right by one bit.
4) Repeat step 3 until eight right shifts have been performed.
5) Exclusive OR the 16-bit CRC register with the next data byte of the packet.
6) Repeat steps 3-5 until all the bytes of the data packet have been used in
step 5.
7) The 16-bit CRC register contains the new checksum to be appended to the
end of the packet, Least Significant Byte first.
5 EXAMPLES OF INFORMATION FRAME FORMAT
5.1 Function Code 01H

Read 1CH (28 Decimal) coils for slave address is 01 and starting address is

0000H.
Request Bytes Example (Hex)
Slave Address 1 01 Send to the slave 01
Function Code 1 01 Read coils
2 00 Starting address is 0000
Starting Address
00
2 00 Read 28 coils
Read Count
1C
2 3D CRC code from PC
CRC Code
C3

Response Bytes Example (Hex)

Slave Address 1 01 Send to the slave 01
Function Code 1 01 Read coils
Read Bytes 1 04 28 coils (total 4 bytes)
Data 1 1 30 The content of address 07H－00H
Data 2 1 00 The content of address 0FH－08H
1
Data 3 93 The content of address 17H－10H
1
Data 4 0A The content of address 00001010
2 18 CRC code from PC
CRC Code
26
07H－00H can be expressed as 30H (00110000). 07H is the most significant
bit and 00H is the least significant bit. 07H － 00H status is
OFF-OFF-ON-ON-OFF-OFF-OFF-OFF. Data 4 is 0AH (00001010) and
address is the content of 17H－10H.
5.2 Function Code 03H
Read 3 holding registers for slave address is 01 and starting address is 0026H.
Address Data (Hex)
0006 00DC
0007 00DF
0008 00D2

Request Bytes Example (Hex)

Slave Address 1 01 Slave address is 01
 Function Code 1 03 Read register
2 00 Starting address is 0006
Starting Address
06
2 00 Read 3 registers (total 6 bytes)
Read Count
03
2 E5 CRC code from PC
CRC Code
CA

Response Bytes Example (Hex)

Slave Address 1 01 Slave address is 01
Function Code 1 03 Read register
Read Count 1 06 3 registers (total 6 bytes)
2 00 The content of address 0006
Data1
DC
2 00 The content of address 0007
Data 2
DF
2 00 The content of address 0008
Data 3
D2
2 41 CRC code from PC
CRC Code
01
5.3 Function Code 05H
Slave address is 01 and starting address is 1 coil of 0002H. Set 0002 as 1.

Address Data (Hex)

0000 0
0001 1
0002 0

Note: Set FF00H as 1 and 0000H as 0, others are defined as illegal status that
won’t affect the digital input.
Request Bytes Example (Hex)
Slave Address 1 01 Slave address is 01
Function Code 1 05 Set single coil
2 00 Starting address is 0002
Starting Address
02
2 FF Set coil as 1
Data
00
2 2D CRC code from PC
CRC Code
FA

Slave Response Bytes Example (Hex)

 Slave Address 1 01 Send to the slave 01
Function Code 1 05 Set single coil
2 00 Starting address is 0002
Starting Address
02
2 FF Set coil as 1
Data
00
2 2D CRC code from PC
CRC Code
FA

6 ERROR HANDLING
When device detected other errors except the CRC code, the slave must send
information to the master. The function code MSB is 1, which means the
response function code by slave should add 128 based on the function code.
Received information from the master, such as a CRC error, will be ignored by
the device.
The slave response error frame format is as follows (CRC excluded):
Address code 1 byte
Function code 1 byte (MSB is 1)
Error code 1 byte
CRC code 2 bytes

Definition of Error Codes

Error
Definition Description
Code
Received function code cannot be
01 Illegal Function Code
supported.
The specified address exceeds the
02 Illegal Data Address
scope of the slave.
Received data value sent by master
03 Illegal Data Value exceeds the data scope of
corresponding address.

7 APPEDIX: ADDRESS AND DATA

7.1 Table 1: Function Code 01H Map Data Field
Address Items Description
0000H 1# Switch State 1: Close; 0: Open
0001H 1# Voltage Normal 1: Normal; 0: Abnormal
0002H 2# Switch State 1: Close; 0: Open
0003H 2# Voltage Normal 1: Normal; 0: Abnormal
0004H Auto/Manual 1: Auto; 0: Manual
0005H 1# Power Priority 1: Priority; 0: Standby
0006H 2# Power Priority 1: Priority; 0: Standby
0007H Start Generator Output 1: Start Output; 0: Stop Output
0008H Fault 1: Fault; 0: No Fault
0009H 1# Switch Alarm 1: Active
000AH 2# Switch Alarm 1: Active
000BH 1# Fail To Close 1: Active
000CH 2# Fail To Close 1: Active
000DH 1# Fail To Open 1: Active
000EH 2# Fail To Open 1: Active
000FH Fail To Changeover 1: Active
0010H Common Warning 1: Warning; 0: No Warning
0011H 1# Over Voltage 1: High; 0: Normal
0012H 1# Under Voltage 1: Low; 0: Normal
0013H 1# Lack Of Phase 1: Lack of Phase; 0: Not Lack of Phase
0014H 2# Over Voltage 1: High; 0: Normal
0015H 2# Under Voltage 1: Low; 0: Normal
0016H 2# Lack Of Phase 1: Lack of Phase; 0: Not Lack of Phase
0017H Over Current 1: Over Current; 0: Normal
0018H 1# Over Frequency 1: Over Frequency; 0: Normal
0019H 1# Under Frequency 1: Under Frequency; 0: Normal
001AH 2# Over Frequency 1: Over Frequency; 0: Normal
001BH 2# Under Frequency 1: Under Frequency; 0: Normal
001CH Common Alarm 1: Active
001DH Delay Alarm Output 1: Active
001EH Aux. Input 1 State 1: Active
001FH 1# Voltage Abnormal 1: Active
0020H 2# Voltage Abnormal 1: Active
0021H 1# Generator Starts 1: Active
0022H 2# Generator Starts 1: Active
1# Reverse Phase
0023H 1: Active
Sequence
2# Reverse Phase
0024H 1: Active
Sequence
Programmable Port 1
0025H 1: Active
Output
Programmable Port 2
0026H 1: Active
Output
0027H 1#(Mains) Over Current 1: Active
0028H 2#(Gens) Over Current 1: Active
 0029H Aux. Input 2 State 1: Active
002AH Aux. Input 3 State 1: Active
002BH Aux. Input 4 State 1: Active
002CH Aux. Output 3 State 1: Active
002DH Aux. Output 4 State 1: Active
002EH Aux. Output 5 State 1: Active
002FH Remote Start Input 1: Active
7.2 Table 2: Function Code 03H Mapping Data Field
Address Items Examples
0000H UAB1
0001H UBC1
0002H UCA1
0003H UAB2
0004H UBC2
0005H UCA2
If read data is 00DCH, the voltage is 220V.
0006H UA1
0007H UB1
0008H UC1
0009H UA2
000AH UB2
000BH UC2
000CH A Phase Current
000DH B Phase Current If read data is 00DDH, the current is 221A.
000EH C Phase Current
000FH Frequency 1 If read data is 01F4H, the frequency is
0010H Frequency 2 50.0Hz.
0011H Total Active Power If read data is 0064H, the power is 100KW
0012H Total Apparent Power (or 100VA).
If read data is 0384H, the power factor is
0013H Power Factor
0.90.
7.3 Table 3: Function Code 05H Mapping Data Field
Address Items Description
0000H Remote 1# Close 1: Close; 0: Inactive
0001H Remote Open 1: Open; 0: Inactive
0002H Remote 2# Close 1: Close; 0: Inactive
Remote Open (same as
0003H 1: Open; 0: Inactive
0001H)
0004H Auto/Manual 0: Manual; 1: Auto
0005H 1# Priority Status 0: Standby; 1: Priority *
0006H 2# Priority Status 0: Standby; 1: Priority *
0007H Alarm Reset 1: Active
 0008H Remote Start Generator 1: Active
0009H Remote Stop Generator 1: Active
Note *: If 1# power is priority, when set 2# power as priority, 1# power will be
turned into standby state automatically. Similarly, if 2# power is priority, when
set 1# power as priority, 2# power