Description

MODBUS Protocol
Default state Item Adoption Protocol
Cm module and background software SDTP protocol
Cm module and external display screen Modbus RTU over Series Port/Modbus TCP/IP
Cm module and third party equipment Modbus RTU over Series Port / Modbus TCP(UDP)/IP / Modbus RTU TCP(UDP)/IP

Port type
COM5,RS-485 type,pin9 is -,pin5 is +,pin1 is GND.

Description of Modbus Protocol

1 Working mode 1 Bits per Byte
All Used in RTU mode, the default Bits per Byte listed as following.

Mode 1:
START 1 2 3 4 5 6 7 8 STOP

Mode 2:
START 1 2 3 4 5 6 7 8 STOP STOP

Mode 3:
START 1 2 3 4 5 6 7 8 PAR STOP

1.2 Communication rate

The default value is 19200bps, which can be set to 2400,4800,9600, 38400,56000,57600.

1.3 Data representation

All values (analog) are represented by two bytes. Decimal points are expressed as follows:

Category Decimal Unit

places
Cell Voltages 3 V
Cell Resistance 0 uΩ
Ambient 1 ℃
String Voltage 1 V
Current 1 A
SOC 1 %
SOH 1 %
Baud rate 0 BPS
Voltage mean difference/ extreme difference 3 V

2.Command
2.1 Function Code： 03
Format
Default Address：40001－
Data Length：no more than 125 and within the max register number.
Remark: Read the analog. Read 16-bit integer or unsigned integer.

For example：
Modbus TCP
MODBUS RTU Request MODBUS RTU Action Modbus TCP Action
Request
High Bit Service High Bit Service
Slave Address 11 Slave Address 11 0 0
Identifier Identifier
Low Bit Service Low Bit Service
Function Code 3 Function Code 3 A0 A0
Identifier Identifier
High Bit Protocol High Bit Protocol
High Bit Default Address 0 Bit Number 6 0 0
Identifier Identifier
High Bit Data（Register Low Bit Protocol Low Bit Protocol
Low Bit Default Address 6B 2 0 0
Address is 40108） Identifier Identifier
Low Bit Data（Register
High Bit Register 0 2B High Bit Length 0 High Bit Length 0
Address is 40108）
High Bit Data（Register
Low Bit Register 3 2 Low Bit Length 6 Low Bit Length 6
Address is 40109）
Low Bit Data（Register
Low Bit CRC — 2B Unit Identifier 11 Unit Identifier 11
Address is 40109）
High Bit Data（Register
High Bit CRC — 2 Function Code 3 Function Code 3
Address is 40110）
Low Bit Data（Register High Bit Default
2B 0 Bit Number 6
Address is 40110） Address
Low Bit Default High Bit
Low Bit CRC — 6B 2
Address Data（Register
Low Bit
High Bit CRC — High Bit Register 0 2B
Data（Register
High Bit
Low Bit Register 3 Data（Register 2
Address is 40109）
Low Bit
Tips: Register address in MODBUS request must be added 1 and equal to register address in
Data（Register 2B
MODBUS response register address.
Address is 40109）
High Bit
Data（Register 2
Address is 40110）
Low Bit
Data（Register 2B
Address is 40110）

2.2 Function Code： 0x06

Default Address：40001－
Remark: Setting each parameter

For example：
Modbus TCP
MODBUS RTU Request MODBUS RTU Action Modbus TCP Action
Request
High Bit Service High Bit Service
Slave Address 11 Slave Address 11 0 0
Identifier Identifier
Low Bit Service Low Bit Service
Function Code 6 Function Code 6 A1 A1
Identifier Identifier
Register Address High High Bit Protocol High Bit Protocol
High Bit Default Address 0 0 0 0
Bit Number Identifier Identifier

Techfill BMS_CM Communication Protocol(600 cells)B0.xlsx

 Register Address Low Bit Low Bit Protocol Low Bit Protocol
Low Bit Default Address 1 1 0 0
Number Identifier Identifier
High Bit Register 0 Preset Number for High 0 High Bit Length 0 High Bit Length 0
Low Bit Register 3 Preset Number for Low 3 Low Bit Length 6 Low Bit Length 6
Low Bit CRC — Low Bit CRC — Unit Identifier 11 Unit Identifier 11
High Bit CRC — High Bit CRC — Function Code 6 Function Code 6
High Bit Default High Bit Default
0 0
Address Address
Low Bit Default Low Bit Default
1 1
Address Address
High Bit Register 0 High Bit Register 0
Attention: one time can only set one parameter. Low Bit Register 3 Low Bit Register 3

2.3 Function Code：0x10

Default Address：40001－
Data Length：no more than 125 and within the max register number.
Remark： setting several parameters.

For example：
Modbus TCP
MODBUS RTU Request MODBUS RTU Action Modbus TCP Action
Request
High Bit Service High Bit Service
Slave Address 11 Slave Address 11 0 0
Identifier Identifier
Low Bit Service Low Bit Service
Function Code 10 Function Code 10 A2 A2
Identifier Identifier
Register Default High Bit High Bit Protocol High Bit Protocol
Register Default Address High Bit Number 0 0 0 0
Number Identifier Identifier
Register Default Low Bit Low Bit Protocol Low Bit Protocol
Register Default Address Low Bit Number 1 1 0 0
Number Identifier Identifier
Register Number for High Bit 0 Register Number for 0 High Bit Length 0 High Bit Length 0
Register Number for Low Bit 2 Register Number for Low 2 Low Bit Length B Low Bit Length 6
Bit Number 4 Low Bit CRC — Unit Identifier 11 Unit Identifier 11
High Bit Data 0 High Bit CRC — Function Code 10 Function Code 10
High Bit Default
Low Bit Data 0A 0 Bit Number 6
Address
Low Bit Default High Bit Default
High Bit Data 1 1 0
Address Address
Low Bit Default
Low Bit Data 2 High Bit Register 0 1
Address
Low Bit CRC — Low Bit Register 2 High Bit Register 0
High Bit CRC — Bit Number 4 Low Bit Register 2
High Bit Data 0
Low Bit Data 0A
High Bit Data 1
Low Bit Data 2
Attention：each time can set several parameters.

2.5 Function Code：0x8X

Remark：When there is an exception after the slave receives the command, the exception will be returned, and the function code is added 80H from the original function code.
Exception Code Specification：
01：Invalid function code
02：Invalid data address
03：Invalid data
04：Slave equipment failure
05：Reveived command
06：Slave equipment busy

For example：
MODBUS Request MODBUS Action
Slave Address 11 Slave Address 11
Function Code 6 Function Code 86
Register Default Address High Bit Number 0 Exception Code 2
Register Default Address Low Bit Number 1 Low Bit CRC —
Register Number for High Bit 0 High Bit CRC —
Register Number for Low Bit 2
Bit Number 4
High Bit Data 0
Low Bit Data 0A
High Bit Data 1
Low Bit Data 2
Low Bit CRC —
High Bit CRC —

3 Slave Address Introduction

A high four-digit address represents a control module address, and a lower four-digit represents a battery string number.
For example, 0x23 represents access to the third battery pack data of the control unit with address 2.

Techfill BMS_CM Communication Protocol(600 cells)B0.xlsx

 Cell Data
Category Name Reference Data Address Description
Cell voltage Voltage update time：Year/Month 410001 2710H Voltage update time
data Last Voltage Updated Date Day/Hour 410002 2711H
618 Minute/Second 410003 2712H
Cell Voltage 1# 410004 2713H Battery real-time cell voltage value, take 3 decimal places, unit: V
Cell Voltages
Cell Voltage 2# 410005 2714H
Cell Voltage 3# 410006 2715H
…… ……
Cell Voltage600# 410603 296AH
Cell internal Internal resistance update
410604 296BH Internal resistance update time
resistance data Last Resistance Updated time：Year/Month
618 Date Day/Hour 410605 296CH
Minute/Second 410606 296DH
Cell Resistance Cell Resistance 1# 410607 296EH Internal resistance of battery, unit: u Ω
600 Cell Resistance 2# 410608 296FH
Cell Resistance 3# 410609 2970H
…… ……
Cell Resistance600# 411206 2BC5H
Cell Battery temperature update
411207 2BC6H Battery temperature update time
temperature Cell temperature update time：Year/Month
data time Day/Hour 411208 2BC7H
618 Minute/Second 411209 2BC8H
Cell temperature Cell Temperature 1# 411210 2BC9H Battery temperature value
600 Cell Temperature 2# 411211 2BCAH Unit: ℃, 1 decimal place, offset 50℃
Cell Temperature 3# 411212 2BCBH
…… ……
Cell Temperature 600# 411809 2E20H
Battery alarm Each bit represents a state, 0 for normal, 1 for alarm. Starting from B0, it is expressed
failure as following:
1800 Cell voltage alarm (0), cell voltage 0: high/1: low (1), cell voltage alarm level (2-3)（The
Battery alarm status 1 Battery alarm status 1# 411810 2E21H default 00 is a level 1 alarm, 01 is a level 2 alarm, 10 is a level 3 alarm, and 11 is a
level 4 alarm）, cell internal resistance alarm (4), cell internal resistance 0: high/1: low
(5), cell internal resistance alarm level (6-7), cell temperature alarm (8), cell
temperature 0: high/1: low (9), cell temperature alarm level (10-11), retain(12),
600 Battery alarm status 2# 411811 2E22H
Battery alarm status 3# 411812 2E23H
…… ……
Battery alarm status 600# 412409 3078H
Each bit represents a state, 0 for normal, 1 for protection. Starting from B0, it is
expressed as following:
Uneven cell voltage (0), uneven cell temperature (1), uneven cell internal resistance (2),
Battery alarm status 2 Battery alarm status 2-1# 412410 3079H
high floating voltage (3), low floating voltage (4), battery open-circuit (5), retain (6),
battery ground alarm (7), retain(8), retain(9), retain(10), retain(11), reain(12),
retain(13), retain(14), retain(15)
600 Battery alarm status 2-2# 412411 307AH
Battery alarm status 2-3# 412412 307BH
…… ……
Battery alarm status 2-600# 413009 32D0H
Each bit represents a state, 0 for normal, 1 for this state. Starting from B0, it is
expressed as following:
Cell voltage module communication (0), battery temperature module communication
Equipment operation / fault
Equipment operation status 1# 413010 32D1H (1), battery temperature sensor failure (2), cell internal resistance module
status
communication (3), internal resistance test battery voltage abnormality (4), internal
resistance test discharge current abnormality (5), retain (6), retain (7), retain (8), retain
(9), retain (10), retain (11), retain (12), retain (13), retain(14), retain(15)
600 Equipment operation status 2# 413011 32D2H
Equipment operation status 3# 413012 32D3H
…… ……
Equipment operation status 600# 413609 3528H
String String measurement data String voltage 413610 3529H Cell voltage accumulation value, unit: V, 1 decimal place
measurement
String voltage module measurement voltage (valid when string voltage module or GD
data External string voltage 413611 352AH
module is available), unit: V, 1 decimal place
33 Charge/discharge current 413612 352BH Retain: A, 1 decimal place, offset 3000A
Floating current 413613 352CH Retain: A, 3 decimal places, offset 10A
Ambient temperature 1 413614 352DH Retain: ℃, 1 decimal place, offset 50℃
Ambient temperature 2 413615 352EH Retain: ℃, 1 decimal place, offset 50℃
Max. voltage battery number 413616 352FH
Max. battery voltage 413617 3530H
Min. voltage battery number 413618 3531H
Min. battery voltage 413619 3532H
Average cell voltage 413620 3533H
Battery voltage mean difference value 413621 3534H
Battery voltage range value 413622 3535H
Max. internal resistance battery number 413623 3536H
Max. battery internal resistance 413624 3537H
Min. internal resistance battery number 413625 3538H
Min. battery internal resistance 413626 3539H
Average battery internal resistance 413627 353AH
Max. temperature battery number 413628 353BH
Max. battery temperature 413629 353CH
Min. temperature battery number 413630 353DH
Min. battery temperature value 413631 353EH
Average battery temperature 413632 353FH
String SOC 413633 3540H Unit: %, 1 decimal place
String SOH 413634 3541H Unit: %, 1 decimal place
Residual discharge time 413635 3542H Unit: minutes
Retain 413636 3543H
Retain 413637 3544H
Retain 413638 3545H
Ripple voltage 413639 3546H Unit: V, 3 decimal places
Hydrogen concentration 413640 3547H Unit: %, 1 decimal place
Insulation positive resistance 413641 3548H Unit：KΩ
Insulation negative resistance 413642 3549H Unit：KΩ
Retain 413643 354AH
Retain 413644 354BH
Retain 413645 354CH
Retain 413646 354DH
Retain 413647 354EH
Upper limit of grounding battery number 413648 354FH
Lower limit of grounding battery number 413649 3550H
Retain 413650 3551H
Retain 413651 3552H
Retain 413652 3553H
Retain 413653 3554H
Retain 413654 3555H
Retain 413655 3556H
Retain 413656 3557H
Retain 413657 3558H
Battery number with maximum change
413658 3559H
rate of internal resistance
Maximum change rate of internal
413659 355AH Unit: %, 2 decimal places
resistance
Retain 413660 355BH
Retain 413651 3552H
… … …
Retain 414080 36FFH
Cell internal Cell internal resistance
Cell internal resistance change rate 1# 414081 3700H Change rate of battery internal resistance, relative internal resistance reference value
resistance change rate
change rate 600 Cell internal resistance change rate 2# 414082 3701H Unit: %, 2 decimal places
600 Cell internal resistance change rate 3# 414083 3702H
…… ……
Cell internal resistance change rate600# 414680 3957H

Techfill BMS_CM Communication Protocol(600 cells)B0.xlsx

 Category Name Reference Data Address Description
Alarm status of The two registers are a unit, and each bit represents an alarm, 1 for the alarm defined
the whole group for this level, and 0 for the opposite. Starting from B0, it is expressed as following:
High string voltage (16), low string voltage(17), high charge current (18), high discharge
current (19), high ambient temperature (20), low ambient temperature (21), high
404966 1365H
floating string voltage (22), low floating string voltage (23), excessive voltage difference
(24), low SOC (25), low SOH (26), battery thermal runaway (27), excessive ripple (28),
Measurement level 1 alarm content high hydrogen concentration (29), low insulation resistance (30), the battery is
disconnected from the bus (31)
High cell voltage (0), low cell voltage (1), high cell internal resistance (2), low cell
internal resistance (3), high battery temperature (4), low battery temperature (5),
404967 1366H uneven voltage ( 6), uneven cell temperature (7), uneven cell internal resistance (8),
high floating voltage (9), low floating voltage (10), battery open-circuit (11), retain (12),
battery ground alarm (13), retain (14), retain (15)
The two registers are a unit, and each bit represents an alarm, 1 for the alarm defined
for this level, and 0 for the opposite. Starting from B0, it is expressed as following:
String voltage module communication (16), charge/discharge current module
communication (17), floating current module communication (18), ambient temperature
module communication (19), ambient temperature sensor 1 failure (20), ambient
404974 136DH
temperature sensor 2 failure (21), ripple module communication (22), ripple voltage
input failure (23), hydrogen module communication (24), hydrogen sensor failure (25),
Device fault level 1 alarm content insulation module communication (26), insulation module relay failure (27), Ethernet
failure (28), abnormal internal resistance test floating current (29), retain (30), retain
(31)
Battery voltage module communication (0), battery temperature module communication
(1), battery temperature sensor failure (2), battery internal resistance module
404975 136EH communication (3), abnormal internal resistance test battery voltage (4), abnormal
internal resistance test discharge current (5), retain(6), retain(7), retain(8), retain(9),
retain(10), retain(11), retain(12), retain(13), retain(14), retain(15)

Techfill BMS_CM Communication Protocol(600 cells)B0.xlsx

 Status Register
Category Content Reference Data Address Description
System status Buzzer silencing 404901 1324H The buzzer will turn off when this bit is changed to 0xf0f0
register The high byte defaults to 00H, modify it to F0H to restore the
Initialization parameter
parameters to the factory settings; the low byte defaults to 00H,
storage area/data storage 404902 1325H
modify it to F0H to restore the recorded data to the factory
area flag
settings.
Device reset flag 404903 1326H The system will reset when this bit is changed to 0xf0f0
Year/Month 404904 1327H New modification time
Day/Hour 404905 1328H New modification time
Minute/Second 404906 1329H New modification time
Modify this bit to 0xf0f0 and write the time to the corresponding
Clock modification flag 404907 132AH
address, the system will modify the clock
The low byte starts from the B0 bit to indicate that the No. 1-6
Automatic test internal
404908 132BH battery string need to be tested for internal resistance
resistance mark
automatically.
String status Equipment working status 404984 1377H 2 is voltage state, 3 is internal resistance
register Battery status 404985 1378H 0 is floating charge, 1 is discharge, 2 is charging
The high byte is the number of cycles, 06H means the 6th cycle
is being tested, 00H means no internal resistance test, F0H
means the internal resistance test ends normally, F1H means
Internal resistance test status 404986 1379H abnormal end; the low byte means status, 00H means normal,
01H means communication failure , 02H means abnormal
floating current, 04H means abnormal discharge current, and 09
means abnormal circuit voltage.

When this bit is changed to 0xf0f0, the current string will be

Open flag for manual internal
404987 137AH tested for internal resistance, and other battery strings can only
resistance test
be tested after the current battery string test is completed

Manual equalization function When this bit is changed to 0xf0f0, the current string will start
404988 137BH
start the balance function
Manual equalization cell
404989 137CH Cell number of currently being manually balanced
number
Longitudinal internal
When modifying this bit to 0xf0f0, set the current internal
resistance reference value 404990 137DH
resistance value as the reference value
reset sign

Techfill BMS_CM Communication Protocol(600 cells)B0.xlsx

 String Parameter
Category Content Reference Data Address Description
String parameter 0-65535mv can be set, linkage dry
contact (upper computer makes
Cell voltage (Level 1) Cell voltage overcharge alarm value 400268 010BH 2500 mV
judgment: recovery value < alarm
value)
Cell voltage overcharge alarm recovery
400269 010CH 2900-4300mv settable 2450 mV
value
1800-3300mv can be set, and linkage
Cell voltage over-discharge alarm value 400270 010DH 1800 mV
dry contact
Cell voltage over-discharge alarm
400271 010EH 1800-3300mV settable 1850 mV
recovery value
High cell floating voltage alarm value 400272 010FH 2900-4500mV settable 2350 mV
High cell floating voltage alarm recovery
400273 0110H 2900-4500mV settable 2300 mV
value
Low cell floating voltage alarm value 400274 0111H 1800-3300mV settable 1900 mV
Low cell floating voltage alarm recovery
400275 0112H 1800-3300mV settable 1950 mV
value
Uneven cell voltage alarm value 400276 0113H 100 mV
Uneven cell voltage alarm recovery value 400277 0114H 80 mV
Cell voltage range value/alarm value 400278 0115H 200 mV
Cell voltage range value/alarm recovery
400279 0116H 160 mV
value
String voltage (Level 1) Total voltage overcharge alarm value 400319 013EH 250 100mV
Total voltage overcharge alarm recovery
400320 013FH 245 100mV
value
Total voltage over-discharge alarm value 400321 0140H 180 100mV
Total voltage over-discharge alarm
400322 0141H 185 100mV
recovery value
High total floating voltage alarm value 400323 0142H 235 100mV
High total floating voltage alarm recovery
400324 0143H 230 100mV
value
Low total floating voltage alarm value 400325 0144H 190 100mV
Low total floating voltage alarm recovery
400326 0145H 195 100mV
value
Charge discharge current (Level 1) Charge over current alarm value 400357 0164H 500(30500) 0.1A
Charge over current alarm recovery 400358 0165H 450(30450) 0.1A
Discharge over current alarm value 400359 0166H -500(29500) 0.1A
Discharge over current alarm recovery
400360 0167H -450(29550) 0.1A
value
Ambient temperature (Level 1) Ambient high temperature alarm value 400381 017CH 500(1000) 0.1℃
Ambient high temperature alarm recovery
400382 017DH 450(950) 0.1℃
value
Ambient low temperature alarm value 400383 017EH 0(500) 0.1℃
Ambient low temperature alarm recovery
400384 017FH 50(550) 0.1℃
value
Temperature rise alarm value 400385 0180H 100(600) 0.1℃
Temperature rise alarm recovery value 400386 0181H 80(580) 0.1℃
Battery temperature (Level 1) Battery high temperature alarm value 400408 0197H 450(950) 0.1℃
Battery high temperature alarm recovery
400409 0198H 400(900) 0.1℃
value
Low battery temperature alarm value 400410 0199H 50(550) 0.1℃
Low battery temperature alarm recovery
400411 019AH 100(600) 0.1℃
value
Uneven battery temperature alarm value 400412 019BH 50(550) 0.1℃
Uneven battery temperature alarm
400413 019CH 30(530) 0.1℃
recovery value
Alarm coefficient of excessive internal
Internal resistance (Level 1) 400438 01B5H 1500 0.001 times
resistance
Alarm recovery coefficient of excessive
400439 01B6H 1400 0.001 times
internal resistance
Internal resistance uneven alarm
400440 01B7H 300 0.001 times
coefficient
Internal resistance uneven alarm
400441 01B8H 250 0.001 times
recovery coefficient
Alarm coefficient of low internal 400442 01B9H 700 0.001 times
Alarm recovery coefficient of low internal
400443 01BAH 750 0.001 times
resistance
Ripple (Level 1) Ripple upper limit alarm value 400464 01CFH 900 mV
Ripple upper limit alarm recovery value 400465 01D0H 800 mV
Hydrogen (Level 1) Hydrogen ratio upper limit alarm value 400474 01D9H 5 %
Hydrogen ratio upper limit alarm recovery
400475 01DAH 4 %
value
Insulation function (Level 1) Insulation resistance alarm value 400488 01E7H 300 kΩ/V
Insulation resistance alarm recovery 400489 01E8H 500 kΩ/V
Capacity monitoring function (Level 1) SOC low alarm value 400508 01FBH 300 0.10%
SOC low alarm recovery value 400509 01FCH 350 0.10%
SOH low alarm value 400510 01FDH 600 0.10%
SOH low alarm recovery value 400511 01FEH 650 0.10%
Internal resistance
Internal resistance reference value Internal resistance reference value001# 400528 020FH 0 uΩ
reference value
600 Internal resistance reference value002# 400529 0210H 0 uΩ
Internal resistance reference value003# 400530 0211H 0 uΩ
…… … 0 uΩ
…… … 0 uΩ
Internal resistance reference value600# 401127 0466H 0 uΩ

Techfill BMS_CM Communication Protocol(600 cells)B0.xlsx