Manual-Tstep-087-Modbus.pdf - 第3页
complete frame = 01 03 00 00 00 04 44 09 The standard CRC-16/MODBUS check value for the ASCII string "123456789" is 0x4B37 - useful for confirming a from-scratch implementation independently of anything specifi…
S9 and S10
Reserved for future use. Not read by this firmware - their position has no effect. Do not use them to configure
anything.
Switch changes are read once at power-up. Change a switch, then power-cycle the drive.
Addresses and other products
Tstep-087 drives occupy 1-16, TIO-0808 I/O cards 17-24. The ranges do not overlap.
3. Frame format and CRC
Every request and every reply follows the same layout:
[ address ][ function ][ data ... ][ CRC low ][ CRC high ]
• Frames are separated by silence, not a terminator - at least 3.5 character times of no
traffic on the line marks the end of one frame and the start of the next.
• Send a whole frame in one write call. A pause inside a frame - even a few milliseconds - is
read as end-of-frame, which splits the transmission into two fragments and fails CRC on both.
• Maximum frame length is 64 bytes. Anything longer is discarded.
CRC-16/MODBUS
The checksum is CRC-16 with polynomial 0xA001 (reflected), initial value 0xFFFF, no final XOR - the standard
Modbus CRC, not the CRC-16/CCITT or CRC-32 used by some other protocols.
It is computed over every byte from the address through the last data byte - the function code and all data, but not the
CRC bytes themselves.
The CRC is the one field sent low byte first. Every other multi-byte value on this bus - register addresses, quantities,
register values - is big-endian, high byte first. The CRC alone goes on the wire low byte first. This is the most common
error in master implementations, because published CRC-16/MODBUS test vectors are usually quoted as the 16-bit
value, and it is easy to forget that the value must be byte-swapped before it goes on the wire.
Reference implementation
uint16_t crc16_modbus(const uint8_t *data, int length)
{
uint16_t crc = 0xFFFF;
for (int i = 0; i < length; i++) {
crc ^= data[i];
for (int bit = 0; bit < 8; bit++) {
if (crc & 1) crc = (crc >> 1) ^ 0xA001;
else crc = crc >> 1;
}
}
return crc;
}
// appending it to a frame buffer of length n (address .. last data byte)
uint16_t crc = crc16_modbus(frame, n);
frame[n] = (uint8_t)(crc & 0xFF); // low byte first
frame[n + 1] = (uint8_t)(crc >> 8);
Worked check
For the frame 01 03 00 00 00 04 (address 1, read holding registers, start 0x0000, quantity 4):
CRC value = 0x0944
on the wire, low byte first = 44 09
complete frame = 01 03 00 00 00 04 44 09
The standard CRC-16/MODBUS check value for the ASCII string "123456789" is 0x4B37 - useful for confirming a
from-scratch implementation independently of anything specific to this product.
If your framing and CRC are correct, every request frame printed in the worked examples in this manual will
reproduce byte for byte. That is the fastest way to confirm an implementation before it goes anywhere near a real
device: compute the frame, compare it to the one printed here, and only then put it on the wire.
4. Function codes
Code Name Limit
0x03 Read Holding Registers 8 registers per request
0x04 Read Input Registers identical behaviour to 0x03
0x06 Write Single Register -
0x10 Write Multiple Registers 4 registers per request
Any other function code returns exception 01.
32-bit values
Most values on this drive are 32-bit - steps, speeds and positions. Each occupies two consecutive registers, starting
on an even address, high word first:
value = (register[n] << 16) | register[n+1]
That order is fixed and not configurable. Position is signed (two's complement across the pair); everything else is
unsigned.
The 4-register write limit means one transaction carries two 32-bit values.
5. Register map
Identity - read only
Register Name Value
0x0000 Product ID 0x0087
0x0001 Firmware version 0x0200 = version 2.00
0x0002 Unit address 1-16, as set by the switches
0x0003 Capabilities 0x0007 - bit 0 motion, bit 1 potentiometer, bit 2 IN1/IN2
Motion parameters - read/write
Registers Name Units Min Max
0x0200-0x0201 Acceleration steps/s² 1 1000000
0x0202-0x0203 Start speed steps/s 1 100000
0x0204-0x0205 Cruise speed steps/s 1 100000
0x0206-0x0207 Move distance steps 0 2147483647
0x0208-0x0209 Dwell ms - not implemented
0x020A Command - writing this executes
0x020B Command sequence - see section 8
Parameters are staged, not applied. Writing one changes nothing about the motor - they take effect when a command
is written. This is what makes a 32-bit value safe to write as two registers: a half-updated distance sits harmlessly in the
staging area until a command acts on it.
Values are clamped, not refused. A parameter outside its range is silently brought into range at execute time. Read the
register back if you need to know what was accepted.
Acceleration is honoured exactly for any value in range. The start speed is the speed a ramp begins and ends at -
deceleration returns to it rather than to zero.
The dwell registers do nothing. 0x0208-0x0209 accept a value, clamp it and read back correctly, but nothing acts on
it, and state word bit 0x0004 ("waiting on a dwell") can never be set. A master needing a pause between moves must
time it itself.
Live status - read only
Registers Name Units
0x0300-0x0301 Current speed steps/s
0x0302-0x0303 Position steps, signed
0x0304 State word bitmask, below
0x0305 Inputs bit 0 = IN1, bit 1 = IN2
Six contiguous registers in polling order - one 0x03 request with quantity 6 returns the drive's entire live state.
Position counts every step, in every mode - finite moves, continuous runs and seeks alike.
State word - 0x0304
Bit Meaning
0x0001 Moving
0x0002 Direction is clockwise
0x0004 Waiting on a dwell - never set, see above
0x0008 Potentiometer speed control enabled
0x0010 Driver fault - see section 7
Unmapped registers
0x0004-0x01FF, 0x020C-0x02FF and 0x0306 upward are holes and return exception 02.
6. Commands - write to 0x020A
Value Command Uses
0
Stop - ramps down,
never a hard stop
1 Move clockwise distance, speeds, acceleration
2 Move anticlockwise distance, speeds, acceleration
3
Run clockwise until
stopped
speeds, acceleration
4
Run anticlockwise until
stopped
speeds, acceleration
5 Seek input 1 speeds, acceleration
6 Seek input 2 speeds, acceleration
7
Reset position counter to
zero
8
Save parameters to
flash
refused while moving - see below
13 / 14
Potentiometer enable /
disable
17 / 18 Driver enable / disable
19
Clear a latched driver
fault
refused while the fault is live