Modbus RTU frame builder

How the frame is built

A Modbus RTU frame is the unit address, a function code, the data and a CRC. Nothing marks where a frame starts or ends: the silence between frames does that. Every multi-byte field is big-endian, high byte first, except the CRC, which goes low byte first.

The Tstep-087 and TIO-0808 implement exactly these four functions, and answer anything else with exception 01. Function 04 runs the same code as 03 on both, so the two read the same registers.

The CRC, worked through

CRC-16/MODBUS starts at 0xFFFF. Each byte is XORed into the low eight bits, then the register is shifted right eight times; whenever the bit shifted out is 1, the register is XORed with 0xA001, the polynomial 0x8005 reflected. There is no final XOR, and the result goes on the wire low byte first.

crc = 0xFFFF
for each byte:
    crc = crc XOR byte
    repeat 8 times:
        if (crc AND 1) = 1:  crc = (crc >> 1) XOR 0xA001
        else:                crc = crc >> 1
send  crc AND 0xFF,  then  crc >> 8

Worked through for 01 03 00 00 00 01: read one register, the Tstep-087’s product ID, from unit 1.

The CRC is 0x0A84, sent as 84 0A, so the frame is 01 03 00 00 00 01 84 0A. A Tstep-087 at address 1 answers 01 03 02 00 87 F8 26. Two more to check an implementation against: 01 03 00 00 00 0A ends C5 CD, and the nine ASCII characters 123456789 give 0x4B37.

Byte order

• 16-bit values, which is addresses, quantities and register contents, go high byte first: register 0x020A is sent as 02 0A.
• 32-bit values take two registers on both products, high word first, starting on an even address. The order is fixed in the firmware and cannot be changed. A cruise speed of 2000 steps/s is 0x000007D0: register 0x0204 holds 0x0000, 0x0205 holds 0x07D0, and the data bytes are 00 00 07 D0.
• Position, 0x0302–0303, is signed, two’s complement across the pair: -1 step reads FF FF FF FF. Every other value is unsigned.
• The CRC is the only field sent low byte first.

Writing cruise speed 2000 and move distance 6000 to a Tstep-087 at address 1 in one frame: 01 10 02 04 00 04 08 00 00 07 D0 00 00 17 70 8E 86. The drive acknowledges with 01 10 02 04 00 04 81 B3.

Limits, silences and exceptions

• At most 8 registers per read and 4 per write, which is two 32-bit values. More is exception 03.
• The longest frame either product accepts is 64 bytes. A longer one is dropped with no reply.
• No reply at all to a frame for another address, a frame with a bad CRC, a frame of the wrong length for its function, or a broadcast to address 0. A broadcast write is carried out but never answered.
• Reading a register that is not mapped, or a span that runs into one, is exception 02, never a zero.
• Motion parameters (acceleration, speeds, distance, dwell) are staged. Writing one changes nothing until a command is written to 0x020A, and an out-of-range value is clamped at that moment rather than refused. The TIO-0808’s own I/O registers refuse an out-of-range value with exception 03 and keep their old value.
• A function 16 write checks that every target register exists before writing any of them, then writes them one at a time. If one refuses its value, the registers before it in the frame have already been written.
• Write a new number to the command sequence register, 0x020B, before each command, and a retried command runs once rather than twice.

Timing

RTU frames are separated by at least 3.5 characters of silence. Both products run their serial port at 8 data bits, no parity and 1 stop bit, so one character is 10 bits.

1 character  = 10 / baud seconds
t3.5         = 3.5 × 10 / baud

19200 baud:   t3.5 = 35 / 19200  = 1.82 ms
115200 baud:  t3.5 = 35 / 115200 = 0.304 ms   (the Modbus specification fixes 1.75 ms above 19200)

A pause that long inside a frame splits it in two and both halves fail their CRC, so send each frame in a single write. The firmware decides a frame has ended after 3 ms of silence at either baud rate, so leave at least 5 ms between the end of one request and the start of the next. A device on an 8E1 or 8N2 line has 11 bits to a character instead.

The TIO-0808 map moved at firmware 3.00

From firmware 3.00 the TIO-0808 drives a step/direction axis, and its motion registers sit at the same addresses, with the same meanings, as the Tstep-087’s. The card’s own I/O moved to make room.

The failure is silent. A master written for 2.00 that polls 0x0300 for the input port now reads the low word of the current speed, and both are small, plausible numbers. Read register 0x0001 first: 0x0300 or higher means the 3.00 map this tool uses. The output port also shrank from eight bits to six, because OUT7 and OUT8 became the step and direction pins.

Register maps

Tstep-087, firmware 2.00

TIO-0808, firmware 3.00

Commands, written to 0x020A

Any other value is refused with exception 03. A command sent with a sequence number the device has already executed is acknowledged and not carried out again.

Switches and wiring

• Tstep-087 address: 1 + (1 × S4 + 2 × S5 + 4 × S6 + 8 × S7), counting a switch when it is on (closed). All off is 1, all on is 16. S8 off is 19200 baud, on is 115200. S9 and S10 are not read. The drive reads its switches at power-up.
• TIO-0808 address: 17 + (1 × AD0 + 2 × AD1 + 4 × AD2), so 17 to 24. The BAUD switch off is 19200, on is 115200, read at power-up. The firmware reads the address switches each time it handles a frame.
• The two address ranges do not overlap, so drives and cards can share one bus.
• The bus is RS-485, two-wire, half duplex. Wire A and B to the bus pair; both products switch their own transmit direction.
• Connect the cable shield or signal common to the device’s ground reference.
• Terminate the bus at both physical ends.

Related Tiny Controls products

• Tstep-087-485 stepper driver: the RS-485 drive whose register map is built in above.
• TIO-0808 RS-485 module: the digital and analogue interface card.
• TUSB-485 USB to RS-485 dongle: a way to put a PC on the bus.