Search code examples
protocolsnetwork-protocolsmodbus

How to recognize protocol and port settings in communication with Modbus boiler


That's my first question. I'm trying to turn on/off my heating with an arduino. First I've to figure out how to communicate with it. My thermostat have 4 wires (3V, GND, A+, B-) That's typical 2-wire RS-485 + 3V power to feed the thermostat. I've connected a RS-485 to ethernet converter to monitor the protocol and figure out the commands used by my actual thermostat in order to replicate them with arduino (and automate some tasks). I started with a modbus monitor (Serial Port Monitor) and some packets have a OK checknum and some packets have a BAD checknum. I don't know the configuration of the port so i've tried some 9600 8 bits no parity, 9600 8 bits even parity, 9600 8 bits odd parity and the result is the same. It seems that the packets fit the modbus structure sometimes but not always. Can I assume that the communication protocol is modbus? Why some packets more or less 30% have OK checknum and 70% have BAD checknum?

[23/10/2019 19:57:51]
Modbus Response (COM4)
Address: 7
Function: 15 (0x0f) - Write Multiple Coils
Starting Address: 1 Quantity: 4

Checksum: 1454(OK)

[23/10/2019 19:57:52]
Modbus Response (COM4)
Address: 7
Function: 1 (0x01) - Read Coils Byte Count: 0
Values:

Checksum: 32174(OK)

[23/10/2019 19:57:52]
Modbus Response (COM4)
Address: 7
Function: 1 (0x01) - Read Coils Byte Count: 1
Values: 00
Coils 0-7: 00000000

Checksum: 20736(OK)

[23/10/2019 19:57:52]
Modbus Response (COM4)
Address: 7
Function: 15 (0x0f) - Write Multiple Coils
Starting Address: 1 Quantity: 4

Checksum: 33660(OK)

[23/10/2019 19:57:52]
Modbus Response (COM4)
Address: 7
Function: 15 (0x0f) - Write Multiple Coils

Checksum: 1(BAD)

[23/10/2019 19:57:52]
Modbus Response (COM4)
Address: 0
Function: 4 (0x04) - Read Input Registers

Checksum: 1454(BAD)

[23/10/2019 19:57:53]
Modbus Response (COM4)
Address: 7
Function: 1 (0x01) - Read Coils

Checksum: 0(BAD)

[23/10/2019 19:57:53]
Modbus Response (COM4)
Address: 0
Function: 7 (0x07) - Read Exception status

Checksum: 32174(BAD)

[23/10/2019 19:57:53]
Modbus Response (COM4)
Address: 7
Function: 1 (0x01) - Read Coils

Checksum: 256(BAD)

[23/10/2019 19:57:53]
Modbus Response (COM4)
Address: 7
Function: 15 (0x0f) - Write Multiple Coils
Starting Address: 1 Quantity: 4

Checksum: 256(BAD)

Do you think that modbus is the protocol being used or should I try some other protocol? How can I be sure that the port communication settings (9600 8 bits even parity) are OK?

Thank you guys!


Solution

  • I solved the issue. The problem was that I'm using a RS485 to ethernet device to read the bus. The device was buffering frames until the buffer reaches 1024 bytes, then it packets the data in an UDP packet and sends it to my PC. That was breaking the modbus frames. A modbus frame is delimited by a silent period of 3,5 times of a symbol. I configured the buffer to 0 bytes so the device immediately sends the data to my PC and all the CRCs are now OK and the data makes sense. Now I've to reverse engineer the data sent by modbus but that's other topic. Thanks!