REVOV Modbus communication

protocol

20181105
Contents
REVOV Modbus communication protocol ............................................................................................... 1
1 Physical interface ................................................................................................................................. 3
1.1 Physical communication interface ................................................................................................. 3
2 Modbus communication protocol ......................................................................................................... 3
2.1 Function definition.......................................................................................................................... 3
2.2 Byte frame ..................................................................................................................................... 3
2.3 Data transfer rate .......................................................................................................................... 4
2.4 Format of data packet ................................................................................................................... 4
2.4.1 Master node sending format: ................................................................................................. 4
2.4.2 Response format from slave node: ........................................................................................ 5
2.5 Abnormal response....................................................................................................................... 5
2.6 Byte sequence .............................................................................................................................. 7
2.7 Data MAP ..................................................................................................................................... 7
 1 Physical interface
1.1 Physical communication interface

Interface introduction:
There are two RJ45 interface on BMU, the position number are MJ2 and MJ3, MJ3 is RS485
communication interface which will be used to communicate and connect with battery, this
communication cable is the standard parts which had installed. MJ2 is used to connect to
inverter, the PIN is defined as below:
1 8

INVERTER

PIN1 485-A_IN BMU communicate with 485 of inverter.

PIN2 485-B_IN

PIN3

PIN4

PIN5

PIN6

PIN7

PIN8

Remark: 485 interface is Modbus protocol which based on RTU format.

2 Modbus communication protocol

2.1 Function definition

Passive query: Master node query status of slave node through order. This communication
protocol is monitor interface between BMU and other equipment (such like Inverter), BMU is
salve node, it had defined physical interface, information transmission for format, transfer
process, function define, order code liet and specific information format. Please refer to the
detail information in chapter 2.7 data MAP.

2.2 Byte frame

Data format of each bit are defined in below table:

 Data bit 8bits（Direction is from left to right:
Start bit 1bit Stop bit 1bit
LSB->MSB）

Using asynchronous transmission, byte frame format is :

One start bit, eight data bit（information byte）,no verification, one stop bit, 10 bits in all.

2.3 Data transfer rate

Default bond rate is 9600, can be adjusted according to different system.

2.4 Format of data packet

Each frame includes Address setting、Function code setting、Data area、error checking. Data
packet format are defined in below table:

2.4.1 Master node sending format:

Slave Starting Starting No. of No. of
Address Address(High) Address(Low) Points(High) Points(Low)
Function CRC(Low) CRC(High)
8bit 8bit 8bit 8bit 8bit 8bit 8bit 8bit

Description of each domain:

Slave Address： 1byte, it is slave node address which communicates by the master node.
Each slave node receives to do address recognition, if it does not respond on non-node packet,
will discard it directly. Address set up as 0x01.

Function：1byte, indicates communication requirements. 0x03 means reading information,

can read single register or multi register for one time.

Starting Address：Start address contains two bytes, respectively as Starting

Address(High) and Starting Address(Low)，the actual value correspond to register address,
details please refer to MAP.

No. of Points：To indicate the number of register which obtain from the slave node. No. of
Points contains two bytes, respectively as No. of Points (High) and No. of Points（Low）.
The registers be read should be continuous, and if the registers be read is not continuous, it
should be segmented to obtain.

CRC：CRC field contains two bytes, CRC(Low) and CRC(High).

Note: CRC check polynomial is: G(X)= X16+X15+X2+1。

 2.4.2 Response format from slave node:
Data_1: Data_1: Data_n: Data_n:

Register Register Register Register

Slave Byte (High) (Low) (High) (Low)
Address Function Count CRC(Low) CRC(High)
8bit 8bit 8bit 8bit 8bit 8bit 8bit 8bit 8bit

Description of each domain:

Slave Address: 1byte, it is slave node address which communicates by the master node.
Each slave node receives to do address recognition, if it does not respond on non-node
packet, will discard it directly.

Function: 1byte, respond to the communication requirement of the host device, in accord
with the host device.

Byte Count: 1byte, to indicate the data length, the data is from slave node back to the
master node, according to the order of low to high.

Data_1 ~ Data_n(Data): To indicate the data from slave node back to the master node, the
“n” of

“Data_n” is decimal value of “Byte Count”.

CRC(Cyclic redundancy check): CRC domain contains two bytes, CRC(High) and
CRC(Low).

Note: CRC check polynomial is: G(X)= X16+X15+X2+1。

2.5 Abnormal response

Master device sends a query to a slave device it expects a normal response, some possible

events can occur from the master’s query:

➢ Slave device receives the query without a communication error, and can handle the
query
normally, it returns a normal response

➢ Slave does not receive the query due to a communication error, no response is returned.

The master program will eventually process a timeout condition for the query.

➢ If the slave receives the query, but detects a communication error (parity, LRC or CRC),

no response is returned. The master program will eventually process a timeout condition

for the query.

 ➢ Slave receives the query without a communication error, but cannot handle it (for

example, if the request is to read a non-existent coil or register), the slave will return an

exception response informing the master of the nature of the error.

Abnormal response command format is as below:

Slave Address Function Data CRC(Low) CRC(High)
8bit 8bit 8bit 8bit 8bit
Slave node response message domain as below:

Slave Address: 1byte, it is slave node address which communicates by the master node.

Each slave node receives to do address recognition, if it does not respond on non-node packet,

will discard it directly.

Function: 1byte, respond to the communication requirement of the host device, in accord with

the host device. For an exception response, the slave returns a code that is equivalent to the

original function code with its most–significant bit set to a logic 1.

Byte Count : 1byte.

Data: 1byte, indicate abnormal code back from node. Defined as below:

0x01：The function code received in the query is not an allowable action for the slave.
If a Poll

Program Complete command was issued, this code indicates that no program function
preceded it.

0x02：The data address received in the query is not an allowable address for the
slave.

0x03：A value contained in the query data field is not an allowable value for the slave.

0x04：An unrecoverable error occurred while the slave was attempting to perform the

requested action.

0x05：The slave has accepted the request and is processing it, but a long duration of

time will be required to do so. This response is returned to prevent a timeout error from

occurring in the master.

The master can next issue a Poll Program Complete message to determine if processing is
completed.

0x06：The salve is engaged in processing a long-duration program command. The

master should retransmit the message later when the slave is free.
 0x07：The slave cannot perform the program function received in the query.

0x08：The salve attempted to read extended memory, but detected verify error in the

memory. The master can retry the request, but service may be required on the slave device.

0xFF：Other undefined error.

All orders which defined as reserved data bytes are uniform regulations to 0xFF.

2.6 Byte sequence

Multi-byte data transmitted sequence on the BUS is decided by system. When send

information on standard Modbus, each character or byte transmitted in the order from left to

right (or from low to high).

2.7 Data MAP

Storage register address is : 4XXXX, holding register 40001, data address is register

0000 （Register number）, please refer to the BMU Modbus protocol MAP which include

detail information domain:

Register Data Data Scaling

Data name Description Byte sequence
number length type /Unit

usBatChgVolt Batter charge Voltage (High) 2byte U16 0.1V

0 (Low)

usCHGCurrLimit DC charge current limitation (High) 2byte U16 0.1A

1 (Low)

usDSGCurrLimit DC discharge current limitation (High) 2byte U16 0.1A

2 (Low)

usBatDSGVolt discharge voltage (High) 2byte U16 0.1V

3 (Low)

usSOC SOC value (High) 2byte U16 %

4 (Low)
 usSOH SOH value (High) 2byte U16 %
5 (Low)

usHiResSOC HiResSOC(Reserve) (High) 2byte U16 %

6 (Low)

usReserve_Reg7 Reserve (High) 2byte U16

7 (Low)

usRealBatVolt Batter Voltage (High) 2byte U16 0.01V

8 (Low)

usRealBatCurr Battery Current (High) 2byte U16 0.1A

9 (Low)

usRealBatTemp Battery Temperature (High) 2byte U16 0.1℃

10 (Low)

usReserve_Reg11 Reserve (High) 2byte U16

11 (Low)

ulBatAlarm Alarms (High_High) 4byte U32

(High_Low)
12
(Low_High)
(Low_Low)

13

ulBatWarning Warnings (High_High) 4byte U32

(High_Low)
14
(Low_High)
(Low_Low)

15

ulEvent Events (Highest_High) 8byte U32

(Highest_Low)
16
(Mid_High)
(Mid_Low)
(Mid_High)
(Mid_Low)
17
(Lowest_High)

(Lowest_Low)

18
 19

byManufacturerName Manufacturer-Name-ASCII (Highest_High) 8byte U8

(Highest_Low)
20 (Mid_High)
(Mid_Low)
(Mid_High)
(Mid_Low)
(Lowest_High)
21
(Lowest_Low)

22

23

byTypeVerCap Battery Type (High) 2byte U8

24 (Low)

BMU software Version (High) 2byte U8

25 (Low)

Battery Capacity (High) 2byte U16 AH

26 (Low)

BMU software Version Date (High) 2byte U8

27 (Low)

Total discharge capacity (AH) (High_High) 4byte U32

28 (High_Low)
TotalDisAH (Low_High)
(Low_Low)
29

Remark: From register 12 to 15, the information mechanism of alarms and Warnings relies on the
each two bits （2-bit）,every two bit indicates one information, the first bit (here means bit0)
described the raise of warning or alarm and another bit(here means bit1) described information had
left. In these combination, Only one of these combined bits should be set to create a message. If both
bits are set (or cleared), no change or message is detected.
Bit 0 Bit 1 Description
0 0 Ignored
1 0 Alarm or warning raised
 0 1 Alarm or warning cleared
1 1 ignored
Alarm and warning code in MAP, there are totally 8bytes, analysis in below table(every two bit):
Byte Bit Name
0 0+1 Alarm - General
0 2+3 Alarm - Battery High Voltage
0 4+5 Alarm - Battery Low Voltage
0 6+7 Alarm - Battery High Temp
1 0+1 Alarm - Battery Low Temp
1 2+3 Alarm - Battery High Temp Charge
1 4+5 Alarm - Battery Low Temp Charge
1 6+7 Alarm - Battery High Current
2 0+1 Alarm - Battery High Current Charge
2 2+3 Reserve
2 4+5 Reserve
2 6+7 Alarm - BMS internal
3 0+1 Alarm - Cell Imbalance
4 0+1 Warning - General
4 2+3 Warning - Battery High Voltage
4 4+5 Warning - Battery Low Voltage
4 6+7 Warning - Battery High Temp
5 0+1 Warning - Battery Low Temp
5 2+3 Warning - Battery High Temp Charge
5 4+5 Warning - Battery Low Temp Charge
5 6+7 Warning - Battery High Current
6 0+1 Warning - Battery High Current Charge
6 2+3 Reserve
6 4+5 Reserve
6 6+7 Reserve
7 0+1 Reserve