M2M-DMTME Modbus Protocol 2.1
M2M-DMTME Modbus Protocol 2.1
M2M-DMTME Modbus Protocol 2.1
Communication protocol
M2M/DMTME Instruments – Communication Protocol
Technical specification V.2.1
2 of 13
M2M/DMTME Instruments – Communication Protocol
Technical specification V.2.1
Communication parameters
Baud rate 2400 19200 (for DMTME)
4800 19200 (for M2M)
Data bit 8
Stop bit 1, 2 (only with parity = none) or 1 (with
parity = odd, even or none)
Parity Even, odd, none
aM2M models where the serial interface is available are: M2M MODBUS, M2M ALARM,
M2M I/O. For simplicity, if not specified, all the models will be listed in the document with
M2M.
3 of 13
M2M/DMTME Instruments – Communication Protocol
Technical specification V.2.1
In the previous figure, if the M2M is the last instrument installed in the RS485
network, is possibile to avoid the terminal resistor connecting pin T with pin B.
T1 T2 T3
ADDRESS FIELD = 8 bits
FUNCTION CODE = 8 bits
DATA FIELD = N x 8 bits
ERROR CHECK = 16 bit CRC
T1 T2 T3
4 of 13
M2M/DMTME Instruments – Communication Protocol
Technical specification V.2.1
in which:
a) the Address field contains the address of the Slave to which the message is
sent
b) the Function field contains the code of the function that must be carried
out by the Slave
c) the Data field contains the information needed by the Slave to carry out a
specific function or contains data collected from the Slave in response to a
question
d) the CRC field allows both the Master and the Slave to check a message in
order to detect any errors in transmission. Sometimes, due to electrical
“noise” or other interference, a message may be changed during the
transmission from one unit to another. The error check ensures that
neither the Master nor the Slave react to messages that have been haltered
e) the T1 T2 T3 sequence represents the time that separates one frame from
another, and corresponds to at least 3 and a half characters: during this
period no one is allowed to talk on the bus, to let the instruments detect
that a frame is over and another one is starting
In RTU mode, the synchronisation of the frame can be maintained only by
simulating a synchronous message. The receiving device measures the time that
separates the reception of one character and the reception of the subsequent
one (for example, between address and function). If this time is longer than the
time needed to transmit three and a half characters, then the message is
considered lost and the next character arriving is considered to be an address,
in other words the beginning of a new frame.
5 of 13
M2M/DMTME Instruments – Communication Protocol
Technical specification V.2.1
CRC generation
The CRC used in Modbus follows the standard CRC-16 defined by CCITT.
Many algorithms are ready off-the-shelf; an algorithm written in C, using a
look-up table, is reported below:
word crc16_rev_table[256] =
{ 0x0000, 0xC0C1, 0xC181, 0x0140, 0xC301, 0x03C0, 0x0280, 0xC241,
0xC601, 0x06C0, 0x0780, 0xC741, 0x0500, 0xC5C1, 0xC481, 0x0440,
0xCC01, 0x0CC0, 0x0D80, 0xCD41, 0x0F00, 0xCFC1, 0xCE81, 0x0E40,
0x0A00, 0xCAC1, 0xCB81, 0x0B40, 0xC901, 0x09C0, 0x0880, 0xC841,
0xD801, 0x18C0, 0x1980, 0xD941, 0x1B00, 0xDBC1, 0xDA81, 0x1A40,
0x1E00, 0xDEC1, 0xDF81, 0x1F40, 0xDD01, 0x1DC0, 0x1C80, 0xDC41,
0x1400, 0xD4C1, 0xD581, 0x1540, 0xD701, 0x17C0, 0x1680, 0xD641,
0xD201, 0x12C0, 0x1380, 0xD341, 0x1100, 0xD1C1, 0xD081, 0x1040,
0xF001, 0x30C0, 0x3180, 0xF141, 0x3300, 0xF3C1, 0xF281, 0x3240,
0x3600, 0xF6C1, 0xF781, 0x3740, 0xF501, 0x35C0, 0x3480, 0xF441,
0x3C00, 0xFCC1, 0xFD81, 0x3D40, 0xFF01, 0x3FC0, 0x3E80, 0xFE41,
0xFA01, 0x3AC0, 0x3B80, 0xFB41, 0x3900, 0xF9C1, 0xF881, 0x3840,
0x2800, 0xE8C1, 0xE981, 0x2940, 0xEB01, 0x2BC0, 0x2A80, 0xEA41,
0xEE01, 0x2EC0, 0x2F80, 0xEF41, 0x2D00, 0xEDC1, 0xEC81, 0x2C40,
0xE401, 0x24C0, 0x2580, 0xE541, 0x2700, 0xE7C1, 0xE681, 0x2640,
0x2200, 0xE2C1, 0xE381, 0x2340, 0xE101, 0x21C0, 0x2080, 0xE041,
0xA001, 0x60C0, 0x6180, 0xA141, 0x6300, 0xA3C1, 0xA281, 0x6240,
0x6600, 0xA6C1, 0xA781, 0x6740, 0xA501, 0x65C0, 0x6480, 0xA441,
0x6C00, 0xACC1, 0xAD81, 0x6D40, 0xAF01, 0x6FC0, 0x6E80, 0xAE41,
0xAA01, 0x6AC0, 0x6B80, 0xAB41, 0x6900, 0xA9C1, 0xA881, 0x6840,
0x7800, 0xB8C1, 0xB981, 0x7940, 0xBB01, 0x7BC0, 0x7A80, 0xBA41,
0xBE01, 0x7EC0, 0x7F80, 0xBF41, 0x7D00, 0xBDC1, 0xBC81, 0x7C40,
0xB401, 0x74C0, 0x7580, 0xB541, 0x7700, 0xB7C1, 0xB681, 0x7640,
0x7200, 0xB2C1, 0xB381, 0x7340, 0xB101, 0x71C0, 0x7080, 0xB041,
0x5000, 0x90C1, 0x9181, 0x5140, 0x9301, 0x53C0, 0x5280, 0x9241,
0x9601, 0x56C0, 0x5780, 0x9741, 0x5500, 0x95C1, 0x9481, 0x5440,
0x9C01, 0x5CC0, 0x5D80, 0x9D41, 0x5F00, 0x9FC1, 0x9E81, 0x5E40,
0x5A00, 0x9AC1, 0x9B81, 0x5B40, 0x9901, 0x59C0, 0x5880, 0x9841,
0x8801, 0x48C0, 0x4980, 0x8941, 0x4B00, 0x8BC1, 0x8A81, 0x4A40,
0x4E00, 0x8EC1, 0x8F81, 0x4F40, 0x8D01, 0x4DC0, 0x4C80, 0x8C41,
0x4400, 0x84C1, 0x8581, 0x4540, 0x8701, 0x47C0, 0x4680, 0x8641,
0x8201, 0x42C0, 0x4380, 0x8341, 0x4100, 0x81C1, 0x8081, 0x4040};
6 of 13
M2M/DMTME Instruments – Communication Protocol
Technical specification V.2.1
In the example above, the master sends the ‘read function’ Func = 03h to the
slave with address Addr = 1Fh, starting from base register address Data Start
Register = 1000h for Data Regs = 14h consecutive registers. So the command
reads all registers from address 1000h a 1013h. The CRC = 42BBh closes the
data stream.
Reply (Slave)
7 of 13
M2M/DMTME Instruments – Communication Protocol
Technical specification V.2.1
The table above shows the fields in the instrument reply, which are:
- Addressed Slave Addr = 1Fh
- Function code request Func = 03
- Number of data byte following Byte Count = 28h
- Data byte fields requested by the master (Data Out Reg)
- CRC closes the reply data stream (CRC)
There are three particular cases that can happen using this command; the first
is related to the quantity of requested memory, the second is related to the
beginning of the requested segment and the last is related to the quantity of the
requested words.
In particular, if the quantity of the requested bytes is greater than the
instrument’s memory extension, the instrument will answer an “INVALID
DATA” for the not available values; for example, if are requested 20 bytes
from the last fourth valid address, a part of the request overflows in the non
available memory. The exceeded bytes will be filled with the value 00,
indicating a non-managed value for those memory cells.
The second particular case is related to a request starting from a non-valid
address, when the request starts from an address not present in the following
table. In this case the instrument will answer with an exception “02 ILLEGAL
DATA ADDRESS”.
The last particular case is the request of a number of words greater than the
maximum for the instrument: in this case the instrument will answer with an
exception “02 ILLEGAL DATA address”.
8 of 13
M2M/DMTME Instruments – Communication Protocol
Technical specification V.2.1
Memory map
The following table indicates the correspondence between the address of the
location, the number of accessible words beginning with that address, the
description of the measurement value, the unit of measurement of the
measurement value and the binary format.
9 of 13
M2M/DMTME Instruments – Communication Protocol
Technical specification V.2.1
109ChIII 2 AVER. ACTIVE POWER from PULSES INPUT (CH1) Watt Unsigned Long
109EhIII 2 AVER. REACT. POWER from PULSES INPUT (CH2) Var Unsigned Long
10A0hIII 2 ACTIVE ENERGY from PULSES INPUT (CH1) Wh * 100 Unsigned Long
10A2hIII 2 REACTIVE ENERGY from PULSES INPUT (CH2) VArh * 100 Unsigned Long
10A4hII 2 CURRENT THRESHOLD for TIMER-2 ACTIVATION mA Unsigned Long
10A6hII 2 3-PHASE SYS. APPARENT ENERGY VAh * 100 Unsigned Long
10A8hII 2 APPARENT ENERGY L1 VAh * 100 Unsigned Long
10AAhII 2 APPARENT ENERGY L2 VAh * 100 Unsigned Long
10AChII 2 APPARENT ENERGY L3 VAh * 100 Unsigned Long
10AEhII 2 3-PHASE SYS. GENERATED ACTIVE ENERGY Wh * 100 Unsigned Long
10B0hII 2 GENERATED ACTIVE ENERGY L1 Wh * 100 Unsigned Long
10B2hII 2 GENERATED ACTIVE ENERGY L2 Wh * 100 Unsigned Long
10B4hII 2 GENERATED ACTIVE ENERGY L3 Wh * 100 Unsigned Long
10B6hII 2 3-PHASE S. GENERATED REACTIVE ENERGY VArh * 100 Unsigned Long
10B8hII 2 GENERATED REACTIVE ENERGY L1 VArh * 100 Unsigned Long
10BAhII 2 GENERATED REACTIVE ENERGY L2 VArh * 100 Unsigned Long
10BChII 2 GENERATED REACTIVE ENERGY L3 VArh * 100 Unsigned Long
10BEhII 2 3-PHASE S. GENERATED APPARENT ENERGY VAh * 100 Unsigned Long
10C0hII 2 GENERATED APPARENT ENERGY L1 VAh * 100 Unsigned Long
10C2hII 2 GENERATED APPARENT ENERGY L2 VAh * 100 Unsigned Long
10C4hII 2 GENERATED APPARENT ENERGY L3 VAh * 100 Unsigned Long
10 of 13
M2M/DMTME Instruments – Communication Protocol
Technical specification V.2.1
Frame format
Memory map
Address Word Measurement description Min Max
VII
For M2M instruments the maximum selectable value is 2000; the command
sets in the instrument simultaneously the value of CT’s secondary current to
5A and the value of CT’s primary current to CT*5A. For example to setting
CT=50 will result in CT = 250/5 in the M2M instrument configuration.
VIII
For M2M instruments the maximum selectable value is 600; the command
sets in the instrument simultaneously the value of VT’s secondary voltage to
100V and the value of VT’s primary voltage to VT*100V
Example:
11 of 13
M2M/DMTME Instruments – Communication Protocol
Technical specification V.2.1
Command map
Add. Word Measurement description MSB Word LSB Word
For the execution of the command the buffer must contain, as value, the two
words indicated on the table.
In this example the id request is sent using Func = 11h to the slave with
address Addr = 02h; the CRC C0DCh ends the frame.
Reply (Slave)
The answer contains address and function, the number of data bytes Len =
04h, the analyser description Instrument type = 50h, the high byte of firmware
version Fw rel. H = 00h and the low byte of firmware version Fw rel. L = 70h.
In this case FW rel. = 0070h (112): this value must be divided by 100 (V1.12).
CRC FE81h ends the frame.
12 of 13
M2M/DMTME Instruments – Communication Protocol
Technical specification V.2.1
Exception Description
01 ILLEGAL FUNCTION An unsupported function code has been sent
02 ILLEGAL DATA ADDRESS Illegal address
03 ILLEGAL DATA VALUE A setup datum is outside of the acceptable limits
13 of 13