MODBUS Protocol between UPS(SMPS) and BMS

(Version V01.07)

Version Modify Date

V01.01 Init 04-21-2015

V01.02 08-13-2015

V01.03 ID arrangement 09-16-2015

V01.04 Register definition 10-19-2015

V01.05 Register re-definition 11-30-2015

V01.06 Lack protected（0025） 10-14-2016

V01.07 Lack units 11-01-2017

1. Data format

1.1 Data byte format

Start bit(1) Data bits（8bits,LSB->MSB） Stop bit(1)

1.2 Baud rate

Baud rate: 9600~19200. (Default baud rate: 19200)

Reading time interval: 100mS

1.3 Packet format

Master : UPS/SMPS

Slave: BMS battery module address 0x01~0x10

Address: Please search the below sheet and picture.

No. Module Address Battery Module ID ID Arrangement

1 0x01 1 ON ON ON OFF

2 0x02 2 ON ON OFF ON

3 0x03 3 ON ON OFF OFF

4 0x04 4 ON OFF ON ON

5 0x05 5 ON OFF ON OFF

6 0x06 6 ON OFF OFF ON

7 0x07 7 ON OFF OFF OFF

8 0x08 8 OFF ON ON ON

9 0x09 9 OFF ON ON OFF

10 0x0a 10 OFF ON OFF ON

11 0x0b 11 OFF ON OFF OFF

12 0x0c 12 OFF OFF ON ON

13 0x0d 13 OFF OFF ON OFF

14 0x0e 14 OFF OFF OFF ON

15 0x0f 15 OFF OFF OFF OFF

16 0x10 0 ON ON ON ON
 1.3.1 Packet send from master
Slave Function Starting Starting Numbers Numbers of CRC CRC
Address code address(Hi) address(Lo) of data(Hi) data(Lo) (Lo) (Hi)

8bit 8bit 8bit 8bit 8bit 8bit 8bit 8bit

1.3.2 Packet response by slave

Slave Function Byte Data 1 Data1 Data n Data n: CRC CRC

Address code count (Hi) (Lo) (Hi) (Lo) (Lo) (Hi)

8bit 8bit 8bit 8bit 8bit 8bit 8bit 8bit 8bit

2.Function Code
2.1 Read registers
Send by the master SMPS

Slave Function Address Address Num of Num of CRC CRC

Address Code (Hi) (Lo) register(Hi) register(Lo) (Lo) (Hi)

0x01-0x10 0x03 0x00 0x00-0xff 0x00 0x00-0xff - -

 Response by salve (BMS)

Slave Function Data1 Data1 Data N Data CRC CRC

Byte Count …
address Code (Hi) (Lo) (Hi) (Lo) (Lo) (Hi)
2*(Num of
0x01-0x10 0x03 …- … … … … ..- -
register)

2.2 Write registers

Send by the master SMPS

Function Address Address Num of Num of

Slave Address Byte Count
Code (Hi) (Lo) register(Hi) Register(Lo)

0x00-0xf 2*(Num of
0x01-0x10 0x10 0x00 0x00 0x00-0xff
f register)

Data1 Data1 DataN DataN CRC CRC

…..
(Hi) (Lo) (Hi) (Lo) (Lo) (Hi)

… …. … … - -

Response by salve (Write success )

Slave Function Address Address Num of Num of CRC CRC

Address Code (Hi) (Lo) register(Hi) register(Lo) (Lo) (Hi)

0x01-0x10 0x10 0x00 0x00-0xff 0x00 0x00-0xff - -

Response by salve (Write Error)

Slave Function CRC CRC

Error num
address Code (Lo) (Hi)

0x01-0x10 0x090 … - -

3.Register

ULONG：Unsigned long,4 bytes

LONG: Signed long, 4 bytes

USHORT: Unsigned int, 2 bytes

SHORT: signed int, 2bytes

RW/Data Comment
Address Content Length Unit
type
 0000 Voltage of pack 2byte R/USHORT 10mV 0~9000*10mV

0~32767：Charge
0001 Current 2byte R/SHORT 10mA
-32768~0:Discharge

Voltage of 16 Cells,
0002-0017 Cell Voltage 32byte R/USHORT mV
2 byte for each cell

BMS cooling fin

0018 2byte R/SHORT ℃ Temperature
temperature
Battery module
0019 internal 2byte R/SHORT ℃ Temperature
temperature

The maximum
0020 2byte R/SHORT ℃ Temperature
cell temperature

Module
0021 2Byte R/USHORT mAs
Remaining AH

Max charging
0022 2Byte R/USHORT A
Current Limit

0023 SOH 2byte R/USHORT % 0-100%

0024 SOC 2byte R/USHORT % 0-100%

0x0000:Stand by
0x0001:Charging
0025 Status 2byte R/USHORT
0x0002:Discharging
0x0004:Protected
0x0001：Over voltage warning
0x0002：Cell Over voltage warning
0x0004：Low voltage warning
0x0008：Low cell voltage warning
0x0010：Charge over current warning
0x0020：Discharge over current warning
0x0100：Charge over temperature warning
0026 Warning 2byte R/USHORT 0x0200：Discharge over temperature
warning
0x0400：Charge low temperature warning
0x0800：Discharge low temperature
warning
0x1000：Low capacity warning
0x2000: Fuse Fail
0x4000: Module Isolated alarm
 0x0001：Over voltage protection
0x0002：Over Cell voltage protection
0x0004：Low voltage protection
0x0008：Low cell voltage protection
0x0010：Charge over current protection
0x0020：Discharge over current protection
0x0100 ： Charge over temperature
protection
0027 Protection 2byte R/USHORT
0x0200 ： Discharge over temperature
protection
0x0400 ： Charge low temperature
protection
0x0800 ： Discharge low temperature
protection
0x1000：Low capacity protection
0x2000：Short circuit protection

0x0001：Voltage measurement error

0028 Error Code 2byte R/USHORT 0x0002：Temperature measurement error
0x0010：Battery cell unbalance

0029 Battery cycle High 16 bit

R/ULONG
--counts
0030 Low 16 bit
Full charge High 16 bit
0031
Capacity(Unit R/ULONG mAS 1Ah=1000*3600 mAs
0032 Low 16 bit
mAS)
0033
Cell
0034 6Byte ℃ 1byte /1 temperature value
Temperature
0035
Full charge
0036 Capacity(Unit 2Byte R/USHORT AH
AH)

0036-0060 Reserved

Low cell voltage

0061 2byte R/USHORT mV
warning data

Low cell voltage

0062 2byte R/USHOR mV
protection data

Low cell voltage

0063 protection 2byte R/USHORT mV
recovery data
 Low voltage
0064 2byte R/USHORT 10mV
warning data

Low voltage
0065 2byte R/USHORT 10mV
protection data

Low voltage
0066 protection 2byte R/USHORT 10mV
recovery data

Over cell voltage

0067 2byte R/USHORT mV
warning data

Over cell voltage

0068 2byte R/USHORT mV
protection data

Over cell voltage

0069 protection 2byte R/USHORT mV
recovery data
Over voltage
0070 2byte R/USHORT 10mV
warning data
Over voltage
0071 2byte R/USHORT 10mV
protection data
Over voltage
0072 protection 2byte R/USHORT 10mV
recovery data
The maximum
0080 2byte R/USHORT 10mA
charging current
The maximum
0081 discharging 2byte R/USHORT 10mA
current
Short circuit
0082 protection 2byte R/USHORT 10mA
current
Protection
0083 2Byte R/USHORT 10mA
charging Current
Protection
0084 discharging 2Byte R/USHORT 10mA
Current

Protect Charge
0090 2Byte RW/SHORT ℃ 充电低温保护(-30 ~+30)
UT
0091 Warn Charge UT 2Byte RW/SHORT ℃ 充电低温告警-30 ~+30
0092 Release Charge 2Byte RW/SHORT ℃ 充电低温恢复-30~+35
 UT
Protect Charge
0093 2Byte RW/SHORT ℃ 充电高温保护 10~80
OT
0094 Warn Charge OT 2Byte RW/SHORT ℃ 充电高温告警 10~80
Release Charge
0095 2Byte RW/SHORT ℃ 充电高温恢复 10~80
OT
Protect Dischare
0096 2Byte RW/SHORT ℃ 放电低温保护-30 ~+30
UT
Warn Discharge
0097 2Byte RW/SHORT ℃ 放电低温告警-30 ~+30
UT
Release
0098 2Byte RW/SHORT ℃ 放电低温恢复-30~+35
Discharge UT
Protect
0099 2Byte RW/SHORT ℃ 放电高温保护 10~80
Discharge OT
Warn Discharge
00100 2Byte RW/SHORT ℃ 放电高温告警 10~80
OT
Release
00101 2Byte RW/SHORT ℃ 放电高温恢复 10~80
Discharge OT

0105-0116 24Byte R Battery Model（Serial No. 字符串）

0117-0119 6Byte R BMS Version(如：6 字节字符串 V03R04)

0120-0124 10Byte R Manufacturer

For example:

Full charge capacity address 0031 to 0032 is show:

According to the picture,the 0031 address code is 4119,the 0032 address code is 57216,

16
So the high 16 bit is 4119,the low 16 bit is 57216, 2  65536

calculate value = Full charge capacity = 4119*65536+57216 = 270000000

theoretical value = Full charge capacity = 75Ah=75*1000*3600 = 270000000

Conclusion： The communication protocol is right.