RTU communication protocol

　　1、 Communication mode

　　1. Electrical standard of communication interface: the communication interface complies with RS-232 and RS -- 485 international standards.

　　2. Communication protocol: adopt Modbus communication protocol RTU mode.

　　3. Communication format agreement:

　　(1) Communication rate: 300 600 1200 2400 4800 9600 optional

　　(2) RTU data format.

　　(3) The character format is 11 bits:

　　One start bit, eight data bits and one parity bit (none if there is no check)

　　One stop bit (when there is verification), two stop bits (when there is no verification).

　　Each character or byte is sent as follows (from left to right):

　　Least significant bit Most significant bit;

　　4. RTU frame:

　　Initial structure ≥ 4 bytes time address code = 1 byte function code = 1 byte

　　Data area = n-byte error check = 16 bit CRC code end structure ≥ 4-byte time

　　Address code: the address code is the first byte of communication transmission. In a communication network, each slave corresponds to a unique address code,

　　The settable range is 0 --- 255 (decimal). According to Modbus communication protocol, the possible slave address

　　The range is 1 --- 247 (decimal). The address code sent by the host indicates the address of the slave to be sent to, and the slave sends

　　The address code of indicates the slave address of the loopback.

　　Function code: the function code is the second byte transmitted by communication. The function number defined by Modbus communication protocol is 1-127

　　The table only uses part of the function codes. The function code sent by the host is to tell the slave machine what operation to perform,

　　Under normal circumstances, the slave will execute the operation and send back the function code as a response. If the returned function code is the highest

　　If the bit is 1, it indicates that the slave does not respond to the operation or sends an error.

　　Data area: the organization of the data area varies according to different function codes. The data area can be the actual value or the meter

　　Address or status setting of the table register.

　　Error check: CRC check. The whole RTU frame is regarded as a continuous binary data string, and only data bits are involved in verification,

　　Round off the start bit, stop bit and optional parity bit.

　　The steps of generating CRC code are as follows:

　　Preset a 16 bit register as all 1 (i.e. hex ffffh), which is called CRC register;

　　The first 8-bit data is different from the lower 8-bit of the CRC register or the result is put back into the CRC register;

　　Shift the 16 bit CRC register to the right by one bit, supplement the highest bit with 0, and detect the shifted bit:

　　If the shift out bit is 0, repeat step 3 (move out again); If the shift out bit is 1, the CRC register

　　If it is different or from polynomial a001h, the result is put back into CRC register;

　　Repeat steps 3 and 4 until 8 bits are removed;

　　Put the next 8-bit data different from the lower 8 bits of CRC register or the result back into CRC register and repeat steps 2, 3, 4 and 5; The final CRC register content is the generated CRC check code.

　　2、 Function description

　　1. Read the contents of single or multiple instrument registers (function code is 03):

　　This function allows the user to read the measured value, recorded data and parameters set by the system from the instrument.

　　Sending format instrument address function code start address high start address low data number high data number low CRC check low CRC check high

　　Example 01h 03h 00h 02h 00h 01h CRC CRC

　　RP_ MJ_ WRITE Length: 0008, Data: 04 03 00 60 00 02 C4 40

　　IRP_ MJ_ WRITE Length: 0008, Data: 04 03 00 64 00 02 85 81

　　The data returned by the instrument includes the instrument address, function code, data length, and CRC check code.

　　2. Write a single data to a register of the instrument (the function code is 06):

　　Loopback format instrument address function code data byte length data high data low CRC check low CRC check high

　　Example 01h 03h 02h 00h 60H CRC CRC

　　This function allows the user to modify the contents of any permitted single register in the instrument; However, the changed data must be within the scope of being received.

　　Send format instrument address function code register address high register address low write data high write data low CRC check low CRC check high

　　Example 01h 06h 00h 10h 00h 01h CRC CRC

　　The instrument feedback information is:

　　Loopback format instrument address function code return correct code CRC check low CRC check high

　　Example 01h 06h 00h CRC CRC

　　3. Write continuous data to instrument register (function code is 10h):

　　This function allows the user to change the contents of any permitted continuous register; However, the changed data must be within the scope of being received.

　　Low bit data register 1 high bit data register 2 low bit address CRC

　　Example 01h 10h 00h 02h 00h 02h 04H 00h 64H 00h 00h 00h CRC CRC

　　The instrument feedback information is:

　　Loopback format instrument address function code return correct code CRC check low CRC check high

　　Example 01h 10h 00h CRC CRC

　　4. Response when error occurs:

　　Return

　　Format instrument

　　Address function code error

　　Code CRC check low CRC check high

　　Example 01h 83h 01h CRC CRC

　　5. Code response:

　　00h = correctly respond to the host operation and return the original function code at the same time;

　　01h = illegal function code, and the highest position of the function code is 1;

　　02h = illegal register, and the highest position of function code is 1;

　　03h = illegal data, and the highest position of the function code is 1;

　　04H = CRC check error, and the highest position of function code is 1.

　　05H = parity error, and the highest position of the function code is 1.

　　III Numerical representation:

　　When the data returned by the instrument is a double byte integer representing the measured value or configuration parameters, the range represented by the double byte integer is - 23767 -- + 32767 (positive numbers are represented by the original code and negative numbers are represented by the complement code). When the read data itself contains decimal places, before or after reading the data, read the decimal parameter x according to the register parameter table of the instrument, and the engineering data = the double byte integer / 10x; For data independent of decimal places, x = 0; For data with fixed decimal places, x = constant value. When writing data to the instrument, the composition of the data is reverse to the decoding method when reading data.

　　Example: read measured value data = 03e8h (double byte hex) = 1000 (decimal)

　　At this time, the read instrument decimal parameter = 0001h (double byte hexadecimal) = 1 (decimal), that is, x = 1

　　Then the quantity of measured value = 1000 / 101 = 100.0, and other data are the same as the above calculation method

　　4、 Description of communication station address and mode parameters

　　When the instrument has additional communication function, two parameters are added: the communication address parameter is CD and the mode parameter is SCT (BT for wt700 Series).

　　SCT. When 0 = 5, 4, 3, 2, 1, 0, the baud rate is 9600, 4800, 2400, 1200, 600, 300;

　　SCT. 1 = 0, 1, 2, no check, odd check, even check;

　　SCT. When 2 = 0 and 1, it is 2-bit stop bit and 1-bit stop bit.

　　Note: SCT 0 is the rightmost value of the display value. SCT. 2、 SCT. When 1 is 0, the corresponding display bit is not on.

　　Address of parameters and measured values of corresponding instrument

　　See "register address description"

　　Register address description

　　No. register address register content status remarks

　　1 0000H alarm 1 limit read / write double byte integer (settable range: decimal - 999 --- 9999), which is related to decimal places

　　2 0001h alarm 2 limit read / write double byte integer (settable range: decimal - 999 --- 9999), which is related to decimal places

　　3 0002h set value read / write double byte integer (settable range: decimal - 999 --- 9999), which is related to decimal places

　　4 0003h indicator type read / write double byte integer (settable range: decimal 1-3), independent of decimal places

　　5 0004h reserved

　　6 0005h alarm type 1 reads / writes double byte integer (settable range: decimal 00-14), independent of decimal places

　　7 0006h alarm No. 1 return difference read / write double byte integer (settable range: decimal - 999 --- 9999), which is related to decimal places

　　8 0007h 2 alarm type read / write double byte integer (settable range: decimal 00-14), independent of decimal places

　　9 0008h alarm 2 return difference read / write double byte integer (settable range: decimal - 999 --- 9999), which is related to decimal places

　　10 0009h decimal places read / write double byte integers (settable range: decimal 0-3), independent of decimal places

　　11 000ah displays the maximum read / write double byte integer (settable range: decimal - 999 --- 9999), which is related to decimal places

　　12 000BH displays the minimum read / write double byte integer (settable range: decimal - 999 --- 9999), which is related to decimal places

　　13 000ch input the maximum read / write double byte integer (settable range: decimal 0 --- 100.0) and the fixed decimal place is 1

　　14 000dh input the minimum value read / write double byte integer (settable range: decimal 0 --- 100.0) and the fixed decimal place is 1

　　15 000eh instrument type read / write double byte integer (settable range: decimal 001 --- 016), independent of decimal places

　　16 000fh output type read / write double byte integer (settable range: decimal 0-2), independent of decimal places

　　17 0010h local address read-only double byte integer (settable range: decimal 0-255) is independent of decimal places

　　18 0011h communication set read-only double byte integer (settable range: decimal 000 --- 025), independent of decimal places

　　19 0060h instrument measurement value read only double byte integer display value + double byte integer decimal places

　　Prompt Description:

　　The maximum length of each data read / write is 16 bytes, that is, the data content of eight registers (one register address corresponds to two bytes of data); When the read / write data length is greater than 16 bytes, an error code will be returned. The data length must correspond to the number of registers to be read / written, otherwise an error code will be returned. You cannot write to a read-only register, otherwise an error code will be returned. In the process of processing the received data, if the parity check and CRC check find errors at the same time, the parity error code will be returned first. When the instrument is in the parameter setting state, it will not respond to the command sent by the host temporarily. It will respond to the host correctly only when it is in the normal measurement state.

　　When the measured value is in fault state, the data read out are invalid data 4e20h (decimal 20000, indicating that the input signal is too large), d8f0h (decimal - 10000, indicating that the input signal is too small).