MODBUS TD-500

From Escort Knowledge Base

Description of MODBUS registers for TD-500

Port settings

Baud rate: 19200 kbps

Data size: 8

Stop-bits: 1

Parity: None

Request and response structure

REQUEST :

  •        (u8) Network address
  •        (u8) 0х03 --> Read command
  •        (u8) Low byte of read reg. (value is ignored)
  •        (u8) High byte of read reg. (value is ignored)
  •        (u8) Low byte of the quantity -|-|-|-|
  •        (u8) High byte of quantity -|-|-|-|
  •        (u8) CRC16 - low byte
  •        (u8) CRC16 - high byte

RESPONSE:

  •        (u8) Network address
  •        (u8) Confirmation of the command (always 0х03)
  •        (u8) Number of bytes requested (always 0x08)
  •   (s8) Temperature
  •        (u8) High byte of Level
  •        (u8) Low byte of Level
  •        (u8) Always 0
  •        (u8) Always 0
  •        (u8) Always 0
  •        (u8) Always 0
  •        (u8) Always 0
  •        (u8) CRC16 - low byte
  •        (u8) CRC16 - high byte

s8 means the value is a signed integer, u8 means an unsigned integer.

Numbered addresses of the response bytes:

Byte ordinal number Byte ordinal number starting from 0 Meaning
1 0 Temperature
2 1 High byte of Level
3 2 Low byte of Level
4 3 Always 0
5 4 Always 0
6 5 Always 0
7 6 Always 0
8 7 Always 0

Baudrate does not change.

19200, 8, n, 1

The number of bits in the package is 12x8, i.e. about 96 pcs

The network number specified in the request is not important, and the number of requested registers is also not important. The main thing is that the checksum matches. The checksum calculation is given below.

Example of TD-500 sensor polling in Terminal program

1 response - response to a request via LLS protocol

2 response - response to a request via ModBUS RTU protocol

TD-500 polling in the Terminal program

$01$03$00$00$00$04$44$09 Command to poll a sensor via Modbus RTU protocol

  • 01 Sensor network address
  • 03 Requested command to read registers
  • 00 00 Register starting from which data is requested
  • 00 04 Number of requested registers
  • 44 09 CRC-16 MODBUS checksum

If you specify a different network address, you need to recalculate the checksum. But there is no point in changing the network address, since the sensor will respond to any network address.

Checksum calculation

In order to calculate the checksum, you can go to the site https://crccalc.com and enter your request without the $ sign, select HEX, CRC-16 ModBUS and click Calc CRC-16

Calculating the checksum on the crccalc site

The resulting value must be written to the command being sent. In this case, the value obtained during the calculation 0C 44 should be written to the command as 44 0C.

Response from the sensor:

01 03 08 14 04 67 00 00 00 00 00 D8 FF

  • 01 - Sensor network address
  • 03 - Read command
  • 08 - Number of bytes in response
  • 14 - Temperature HEX (20°C in DEC)
  • 04 67 - Bytes of level Big Endian HEX (1127 in DEC)
  • 00 00 00 00 00 - reserve 5 bytes, not used
  • D8 FF - CRC-16 ModBUS checksum Little Endian HEX (FF D8)