ZNH_Modbus TCP prototol V1.3
ZNH_Modbus TCP prototol V1.3
CATL PMT
State: (In Analysis)
Update Date:
2022年7月27日
Version:V1.3
宁德时代新能源科技股份有限公司
福建省宁德市蕉城区漳湾镇新港路2号 http://www.CATLbattery.com Page 1 of 21 Pages
Catalogue
System overview...................................................................................................................................4
Communication protocol ........................................................................................................................4
Communication baud rate.......................................................................................................................4
Physical layer........................................................................................................................................4
TCP message format.............................................................................................................................4
Address distribution...............................................................................................................................5
Application layer message format ..........................................................................................................5
Data format definition............................................................................................................................6
BMU address distribution rules...............................................................................................................7
BMU message detailed definition............................................................................................................7
MBMU register address definition ...............................................................................................7
Message data format example.....................................................................................................14
Error frame format......................................................................................................................15
Appendix Ⅰ .......................................................................................................................................16
Appendix Ⅱ .......................................................................................................................................17
Appendix Ⅲ .......................................................................................................................................17
Appendix Ⅳ .......................................................................................................................................18
宁德时代新能源科技股份有限公司
福建省宁德市蕉城区漳湾镇新港路2号 http://www.CATLbattery.com Page 2 of 21 Pages
NO. Version Date Author Audit Changed Contents
宁德时代新能源科技股份有限公司
福建省宁德市蕉城区漳湾镇新港路2号 http://www.CATLbattery.com Page 3 of 21 Pages
System overview
This protocol defines the data exchange format between the PCS monitoring computer and the on-site
monitoring computer of the battery’s energy storage system.
The statute text used in this protocol is the standard modbus TCP/IP protocol.
PMS will be host computer, battery system will be guest computer, port no 502.
Both the host computer and the guest computer should clarify their IP addresses.
All of the messages are transmitted through internet format (big endian).
Communication status with can bus must be maintained during communication. Otherwise, abnormal data
02 will be returned.
Communication protocol
Modbus TCP/IP
100M self-adjusting
Physical layer
Physical layer:IEEE802.3,RJ45 connector with 5 or above 5 type cables
0~15 16~31
Source port Destination port
Sequence number(32bits)
Acknowledgement number(32bits)
Reserve U A P R S F
Data offset Window
(4bits) R C S S Y I
(4bits) (16bits)
G K H T N N
Checksum (16bits) Urgent pointers(16bits)
Options(optional) Padding
Data
……
In the ethernet, the maximum transport unit (MTU) is 1500 chars (8 bit length) long. In an IP package, it
can transport data up to 1480 chars except the IP head (20 chars). In a TCP package, it can transport data up
to 1460 chars except the TCP head (20 chars).
Address distribution
宁德时代新能源科技股份有限公司
福建省宁德市蕉城区漳湾镇新港路2号 http://www.CATLbattery.com Page 4 of 21 Pages
Float name IP address Sub-net mask Gateway DNS server
Guest computer
192.1.1.xxx 255.255.255.0 192.168.1.1 502
(monitoring pc)
Host computer
192.1.1.xxx 255.255.255.0 192.168.1.1
(monitoring server)
After device receives a frame of TCP message from the ethernet correctly, it will extract the modbus
TCP/IP data segment from the frame.
Data segment format is shown as below:
4. Address(byte6)——it means the address of the guest computer being addressed; this protocol specified
the address of guest computer is 64h.
5. Function code(byte7)——order the guest computer being addressed guestto finish required action.
Function code as noted in the table below.
6. Data(byte8~xx)——data field, includes data guest terminal needs to finish some specified function, and
includes uploaded data during servicing.
Function code introduction:
Function code
Definition Function description
(hexadecimal)
0x03h Read multiple registers Host computer reads data of guest computer
0x10h Write multiple registers Host computer modifies data of guest computer
0x06h Write single register Host computer modifies data of guest computer
宁德时代新能源科技股份有限公司
福建省宁德市蕉城区漳湾镇新港路2号 http://www.CATLbattery.com Page 5 of 21 Pages
Data format definition
Ratio Data
Data type Range Offset Actual span Comment
factor quantity
Overall voltage 0.1v/bit 0 ~15000 0 0 ~ 1500v 2byte
宁德时代新能源科技股份有限公司
福建省宁德市蕉城区漳湾镇新港路2号 http://www.CATLbattery.com Page 6 of 21 Pages
Accumulated
0~429496729k
charge/discharge 0.1kwh/bit 0~4294967295 0 4byte
wh
energy
Environment
1℃/bit 0 ~ 250 -50 -50 ~ 200℃ 1byte
temperature
TMS water press 0.1bar/bit 0~250 0 0~25bar 1byte
Real time-year 1y/bit 0 ~ 254 2000 2000~2254y 1byte
Real time–month 1m/bit 1~ 12 0 1~12m 1byte
Real time-day 1d/bit 0 ~ 31 0 0 ~ 31d 1byte
Real time-hour 1h/bit 0 ~ 59 0 0 ~ 59h 1byte
Real time-minute 1min/bit 0 ~ 59 0 0 ~ 59min 1byte
Real time-second 1s/bit 0 ~ 59 0 20 ~ 59s 1byte
Byte Variable
BMU no Register address Comment
quantity description
MBMU data
MBMU 0x0000-0x3ff 2048 MBMU occupies 1024 addresses
field
SBMU1 data
SBMU01 0x0400~0x07ff 2048 SBMU1 occupies 1024 addresses
field
SBMU2 data
SBMU02 0x0800~0x0bff 2048 SBMU2 occupies 1024 addresses
field
0x(400*n) ~ SBMUn data
SBMUn 2048 SBMUn occupies 1024 addresses
0x(400*n+3ff) field
宁德时代新能源科技股份有限公司
福建省宁德市蕉城区漳湾镇新港路2号 http://www.CATLbattery.com Page 7 of 21 Pages
BMU message detailed definition
Data
Register address Description Comment
quantity
System warning
0x0000 2 Detailed in appendix Ⅰ
(with degrees)
System Alarm
0x0001-0x0003 4 Detailed in appendix Ⅱ
(without degrees)
0x0004-0x000f 22 Reserve Reserve
Data
Register address Description Comment
quantity
000 Initialize
001 Normal
010 Full charge
0x0010 2 System status
011 Full discharge
100 Warning status
101 Fault status
Byte
Register address Description Comment
quantity
Battery system level voltage(outer
0x0020 2 System voltage
side)
宁德时代新能源科技股份有限公司
福建省宁德市蕉城区漳湾镇新港路2号 http://www.CATLbattery.com Page 8 of 21 Pages
Battery system current minimum cell
0x0028 2 Min cell temperature
temperature
Register Variable
Register address Description Comment
address description
0x0300- ACAN data For more details-ACAN
ACANtransmit 512
0x03ff transmit field data transmission
BMS->EMS meaasge(read)
Byte
Register address Description Comment
quantity
BMS heartbeats 0-255, updated
0x0300 2 BMS heartbeat
every 1s
BMS high voltage status
0: Power off ready
0x0301 2 BMS_poweron 1: Power on ready
2: Power on fault
3: Power off fault
宁德时代新能源科技股份有限公司
福建省宁德市蕉城区漳湾镇新港路2号 http://www.CATLbattery.com Page 9 of 21 Pages
BMS system status
0: Initial status
1: Normal status
0x0302 2 BMS_status 2: Full charge status
3: Full discharge status
4: Warning status
5: Fault status
EMS->BMS数据(write/read)
Byte
Register address Description Comment
quantity
0x0380 2 EMS heartbeat Pcs heartbeats 0-255, updated every 1s
Command of EMS to control BMS
relay
0: Initial
0x0381 2 EMS_cmd
1: Stay status
2: Power on cmd
3: Power off cmd
0x0382 2 EMS_status EMS system status (reserve)
0x0383 2 CRC_c2b_rtc CRC check
0x0384 2 EMS_RTC _year EMS time-year
0x0385 2 EMS_RTC_month EMS time-month
0x0386 2 EMS_RTC_date EMS time-day
0x0387 2 EMS_RTC_hour EMS time-hour
0x0388 2 EMS_RTC_minute EMS time-minute
宁德时代新能源科技股份有限公司
福建省宁德市蕉城区漳湾镇新港路2号 http://www.CATLbattery.com Page 10 of 21 Pages
0x0389 2 EMS_RTC_second EMS time-second
Command of EMS to control BMS
0x038a 2 EMS_Low_Power_cmd
enter low power mode
1:Start
EMS_insulation_control_c
0x038b 2 insulation detection 2:Turn
md
off insulation detection
Byte
Register address Description Comment
quantity
0: Open
0x0410 2 Precharge relay status
1: Close
0: Not Run
0x0413 2 Fan status
1: Run
0: Not Run
0x0414 2 Balance status
1: Run
0x0415—0x041f X Reserve Reserve
宁德时代新能源科技股份有限公司
福建省宁德市蕉城区漳湾镇新港路2号 http://www.CATLbattery.com Page 11 of 21 Pages
Max allowed charge Battery system current maximum
0x042b 2
current allowed charge current
Max allowed Battery system current maximum
0x042c 2
discharge current allowed discharge current
0x042d 2 Reserve Reserve
lower power status:
0x042e 2 lower power status 0-low power mode
1-normal
0x042f 2 Reserve Reserve
Max single cell Low byte means cell number,
0x0430 2
voltage position High byte means tank number
Min single cell Low byte means cell number,
0x0431 2
voltage position High byte means tank number
Max single cell
0x0432 2 Module number
temperature position
Min single cell
0x0433 2 Module number
temperature position
0x0434-0x0436 X Reserve Reserve
0x0437 2 Sum of cell voltage Sum of cell voltage
0x0438-0x043f 16 Reserve Reserve
0x0440--0x447 X Reserve Reserve
TMS temperature
0x0449 2 TMS temperature value set by BMS
value set by BMS
TMS real mode
0: power off
0x044a 2 TMS real mode 1: cooling mode
2: heating mode
3: self-circulation mode
Rack inlet(TMS
0x044b 2 Rack inlet(TMS outlet) temperature
Outlet) temperature
Rack outlet(TMS
0x044c 2 Rack outlet(TMS inlet) temperature
inlet) temperature
TMS Environment
0x044d 2 TMS Environment temperature
temperature
0x044e 2 TMS demand power TMS demand power
0x044f 2 TMS fault code TMS fault code
Door state
0x0450 2 Door state 0: Close
1: Open
Fan state in control box
Fan state in control
0x0451 2 0: Stop
box
1: Run
0x0452-0x047f X Reserve Reserve
0x0452 2 TMS_OutWaterPress TMS_OutWaterPress
0x0453 2 TMS_BackWaterPress TMS_BackWaterPress
宁德时代新能源科技股份有限公司
福建省宁德市蕉城区漳湾镇新港路2号 http://www.CATLbattery.com Page 12 of 21 Pages
Historical accumulated
0x0454-0x0455 4 Historical cumulative charge energy
charge energy
Historical cumulative
0x0456-0x0457 4 Historical cumulative discharge energy
discharge energy
0x0456-0x047f X Reserve Reserve
Byte
Register address Description Comment
quantity
All cells: M* N (max 576)
M: number of CSC
N: number of cells per CSC
1#CSC cells voltage: 0x480 ~
Detail
(0x480+N-1)
0x0480~0x06bf 576* 2 message-single
2#CSC cells voltage: (0x480+N) ~
cell voltage
(0x480+2N-1)
……
M#CSC cells voltage:
(0x480+(M-1) * N) ~ (0x480+M* N-1)
All cells temperature sensors: M* P
(max 192)
M: number of CSC
P: number of temperature sensor per
CSC
Detail
1#CSC temperatures: 0x6c0 ~
0x06c0~0x077f 192* 2 message-single
(0x6c0+P-1)
cell temperature
2#CSC temperatures: (0x6c0+P) ~
(0x6c0+2P-1)
……
M#CSC temperatures:
(0x6c0+(M-1) * P) ~ (0x6c0+M* P)
宁德时代新能源科技股份有限公司
福建省宁德市蕉城区漳湾镇新港路2号 http://www.CATLbattery.com Page 13 of 21 Pages
CSC Software Show in ASCII ,all CSC belong to this
0x07e0~0x07ef 16
Version SBMU will be the same Version
宁德时代新能源科技股份有限公司
福建省宁德市蕉城区漳湾镇新港路2号 http://www.CATLbattery.com Page 14 of 21 Pages
Message data format example
If the host computer demands those data saved in 0x0420~0x0432 of the guest computer (19 registers,
total 38 bytes), then the messages between host computer and guest computer are shown below:
Register
Transaction Byte Register
Protocol Data System Function 0x0420
process number of 0x0420
identifier length address code high byte of
identifier data low byte of data
data
00H 00H 00H 00H 00H 29H 64H 03H 26H xxH xxH
Ps: data length means the number of total bytes following the data length bytes, and byte number of data
means the bytes’ number of the returned registers.
Ps: data length means the number of total bytes following the data length bytes, and byte number of data
means the bytes’ number of the returned registers.
When host computer demands the same data package from guest computer, it can set communication period
according to the importance of the message, and the smallest period should be bigger than 20ms.
Transaction
Protocol Data System Abnormal
process Function code
identifier length address code
identifier
宁德时代新能源科技股份有限公司
福建省宁德市蕉城区漳湾镇新港路2号 http://www.CATLbattery.com Page 15 of 21 Pages
Previous
Previous function XX in the
00H 00H 00H 00H data 0
code H+128 table below
length xx
Error code
Abnormal
Description
code
0x01 Unsupported function code
0x02 Without can communication
0x03 More than 127 addresses demanded
0x04 Something abnormal happens
0x05~0xff Reserve
宁德时代新能源科技股份有限公司
福建省宁德市蕉城区漳湾镇新港路2号 http://www.CATLbattery.com Page 16 of 21 Pages
Appendix Ⅰ
Appendix Ⅱ
宁德时代新能源科技股份有限公司
福建省宁德市蕉城区漳湾镇新港路2号 http://www.CATLbattery.com Page 17 of 21 Pages
0 Normal
0x0001 bit8 EMS heartbeat fault
1 Fault
0x0001 bit9 Reserve - Reserve
0x0001 bit10 Reserve - Reserve
0x0001 bit11 Reserve - Reserve
0 Normal
0x0001 bit12 Mains power supply lose warning
1 Warning
0 Normal
0x0001 bit13 Mains power supply lose fault
1 Fault
0 Normal
0x0001 bit14 UPS fault
1 Fault
0 Normal
0x0001 bit15 Fire fighting fault
1 Fault
0 Normal
0x0002 bit0 Fire fighting warning
1 Warning
0 Normal
0x0002 bit1 E-Stop press down fault
1 Fault
0 Normal
0x0002 bit2 E-Stop fault
1 Fault
0 Normal
0x0002 bit3 Entrance door fault
1 Fault
0 Normal
0x0002 bit4 Escape door fault
1 Fault
0 Normal
0x0002 bit5 Main load switch fault
1 Fault
0 Normal
0x0002 bit6 Lightning protector fault
1 Fault
0 Normal
0x0002 bit7 Exhaust fan fault
1 Fault
0x0002 Bit8 - Bit10 Reserve - Reserve
Racks numbers of high 0 Normal
0x0002 bit11
voltage power on fault 1 Warning
0x0002 Bit12 - Bit15 Reserve - Reserve
Appendix Ⅲ
宁德时代新能源科技股份有限公司
福建省宁德市蕉城区漳湾镇新港路2号 http://www.CATLbattery.com Page 18 of 21 Pages
01 Single cell undertemperature warning1
0x0400 Bit6-bit7 Single cell undertemperature warni
10 Single cell undertemperature warning2
11 Single cell undertemperature warning3
00 Normal
01 SOC low warning1
0x0400 Bit8-bit9 SOC low warning
10 SOC low warning2
11 SOC low warning3
00 Normal
01 TMS fault level 1
0x0400 Bit10-bit11 TMS fault level
10 TMS fault level 2
11 TMS fault level 3
0x0400 Bit12-bit15 Reserve - Reserve
Appendix Ⅳ
宁德时代新能源科技股份有限公司
福建省宁德市蕉城区漳湾镇新港路2号 http://www.CATLbattery.com Page 19 of 21 Pages
0 Normal
0x0402 bit2 Current sensor abnormalfault
1 Fault
0 Normal
0x0402 bit3 Single cell voltagesampling abnorm
1 Fault
0 Normal
0x0402 bit4 Module temperaturesampling abnor
1 Fault
0 Normal
0x0402 bit5 High voltage circuit openfault
1 Fault
0 Normal
0x0402 bit6 MSD fault
1 Fault
0 Normal
0x0402 bit7 Rack isolate switch fault
1 Fault
0 Normal
0x0402 bit8 Rack fuse fault
1 Fault
0 Normal
0x0402 bit9 Pre-charge Timeout fault
1 Fault
Extreme over current 0 Normal
0x0402 bit10
fault 1 Fault
Contactor coil abnormal 0 Normal
0x0402 bit11
warning 1 Warning
The warning of different
0 Normal
voltage between sampling
0x0402 bit12
voltage and sum voltage
1 Warning
warning
0 Normal
0x0402 bit13 MCAN communicationwarning
1 Warning
0 Normal
0x0402 bit14 CSC Power Fault
1 Fault
0 Normal
0x0402 bit15 Current sensor PowerFault
1 Fault
0 Normal
0x0403 bit0 TMS communication fault
1 Fault
0 Normal
0x0403 bit1 TMS mode conflict fault
1 Fault
0 Normal
0x0403 bit2 Fire fault level 1
1 Fault
0 Normal
0x0403 bit3 Fire fault level 2
1 Fault
0 Normal
0x0403 bit4 TempSensorState
1 Fault
0 Normal
0x0403 bit5 SomkeSensorState
1 Fault
0 Normal
0x0403 bit6 Aerosol state
1 Happened
0 Normal
0x0403 bit7 Aerosol close fault
1 Abnormal opened
0 Normal
0x0403 bit8 Aerosol open fault
1 Abnormal closed
0 Normal
0x0403 bit9 Rack switch state
1 Happened
Over temperature fault in 0 Normal
0x0403 bit10
宁德时代新能源科技股份有限公司
福建省宁德市蕉城区漳湾镇新港路2号 http://www.CATLbattery.com Page 20 of 21 Pages
0x0403 bit10
control box 1 Over temperature fault incontrol box
0 Normal
0x0403 bit11 TMS Make BMS Stop
1 Fault
0 Normal
0x0403 bit12 Fan fault 1#
1 Fan faul
0 Normal
0x0403 bit13 Fan fault 2#
1 Fan fault
0x0403 bit14-bit15 Reserve / Reserve
宁德时代新能源科技股份有限公司
福建省宁德市蕉城区漳湾镇新港路2号 http://www.CATLbattery.com Page 21 of 21 Pages