Implementation and Application of MODBUS Protocol Based on ARM Cortex-M3

As a non-contact non-destructive flaw detection technology, magnetic flux leakage detection has the characteristics of fast detection speed, high sensitivity, no coupling agent, and easy automation. It is a key research direction of rail flaw detection technology. In order to solve the experimental simulation problem in magnetic flux leakage detection research, a non-destructive flaw detection tester based on an embedded system was developed. By implementing MODBUS protocol and inverter communication, it drives the AC motor and mechanical test device to complete motion control and perform non-destructive flaw detection tests.

Aiming at the communication problem of the frequency converter in the non-destructive flaw detection tester, according to the MODBUS protocol, the embedded software based on ARM Cortex-M3 microcontroller was developed using RealView MDK, which realized the MODBUS communication with the frequency converter and completed the motion control function of variable frequency speed regulation.

1 MODBUS protocol

1.1 Introduction to MODBOS Protocol

MODBUS is a communication protocol trademark registered by Gould Ine. The protocol has the characteristics of strong error correction ability, large data transmission volume, good real-time performance, etc. It is a widely used communication language in the field of industrial automatic control and has now become a national standard in my country's industrial automation field.

The MODBUS protocol defines a message structure that a controller can recognize. It describes the process of the controller requesting access and responding to other devices, as well as the specifications for error detection and recording, and establishes a common format for message fields and content. MODBUS belongs to the application layer message transmission protocol, and its communication structure is a one-to-many master-slave query mode, that is, the master-slave mode. There can be multiple slave nodes on the MODBUS network, but there can only be one master node. The master node sends a request operation to the slave node according to the communication protocol. After receiving the request from the master node, the slave device makes a corresponding response and then replies to the master node with a reply message.

1.2 MODBOS protocol composition

The MODBUS protocol has two transmission modes: ASCII mode and RTU mode. In the ASCII mode, data is represented by ASCH character code, and the start and end of the data frame are determined by colon and carriage return characters, and IRC data verification is used; in the RTU mode, data is represented by uncompressed BCD code, and the start of the data frame is determined by time stamp, and CRC data verification is used, which has the advantages of high data throughput, stable transmission, and high communication efficiency.

Since the variable frequency speed regulation system has high safety performance requirements, the RTU transmission mode with high communication efficiency and strict time management is selected. In terms of the composition of the protocol frame, MODBUS defines a basic data protocol unit PDU (Protocol Data Unit) that is independent of the communication layer, and defines the application data unit ADU (Application Data Unit) by adding additional fields such as address and checksum to the PDU to form a complete data frame. The composition of the MODBUS RTU data frame is shown in Table 1.

In determining the start of a data frame, MODBUS RTU uses the time marking method shown in Figure 1, that is, the interval between two adjacent frames must be at least the time it takes for the bus to send 3.5 characters, which is called T3.5.

In the MODBUS data frame, the function code refers to the type of operation requested by the master node to the slave node. Commonly used MODBUS function codes and their functions are shown in Table 2. [page]

MODBUS RTU uses cyclic redundancy check code CRC (Cyclic Redundancy Check), which is a widely used polynomial code with simple coding and low probability of misjudgment. It has been widely used in serial communication, Ethernet, MPEG decoding and other communication fields. During the communication process, the sender divides the data to be sent by a generator polynomial agreed upon by the sender and the receiver, and uses the remainder as the CRC check polynomial, which is attached to the end of the data to be sent as a whole and sent to the receiver. The receiver also divides the received data by the generator polynomial. If the remainder is zero, the transmission is normal. If the remainder is not zero, the transmission is wrong.

2 Circuit connection and hardware parameters

In the non-destructive flaw detection tester, the STM32F103ZET6 microcontroller based on the ARM Cortex-M3 core is selected as the processing core, and the frequency converter uses the F2000-G vector frequency converter produced by Yantai Huifeng Company. The STM32F103ZET6 is connected to the F2000-G through an RS485 link based on MAX3485, and communicates with it according to the MODBUS protocol to realize the control function of variable frequency speed regulation. The RS485 interface circuit is shown in Figure 2. Uart3Rx and Uart3Tx of USART3 of STM32F103ZET6 are connected to RO and DI of MAX3485 for RS232 data transmission and reception; GPI01 of STM32F103ZET6 is connected to the receive enable terminal RE and the transmit enable terminal DE of MAX3485 in I/O mode to uniformly control the communication direction of the RS485 half-duplex bus; and the differential signal terminals A and B of MAX3485 are connected to F2000-G through the socket. At the same time, in order to ensure the communication quality and eliminate the signal reflection on the bus, a 50Ω resistor R1 needs to be connected in series between the differential buses of the RS485 network terminal.

In the initialization process of the peripherals, USART3 needs to be initialized first. According to the requirements of F2000-G, the communication parameters used are: baud rate 9600kb·s-1, 8 data bits, 2 stop bits, and no parity check; secondly, GPI01 of STM32F103ZET6 needs to be initialized to output mode to control the communication direction of RS485; thirdly, since MODBUS RTU uses time stamps to determine the start of the protocol frame, the timer TIM2 of STM32F103ZET6 is used to determine the end of the data frame. In MODBUS RTU, T3.5 usually takes 4 characters to send in engineering applications, so the overflow time of TIM2 is set to 3ms; finally, in order to deal with possible communication failures such as bus delays, this paper uses the system timer SysTick for timeout determination. Taking into account the factors such as the inverter action time and communication delay, the time threshold for timeout determination is 200ms.

3 MODBUS protocol implementation

In the variable frequency speed regulation system, STM32F103ZET6 is responsible for the function control of the variable frequency speed regulation system as the master node, and the inverter F2000-G is responsible for responding to the request of the master node as the MODBUS slave node to complete the motion control of the AC motor. Therefore, the variable frequency speed regulation system in this article is implemented as a master node program based on the MODBUS protocol. The MODBUS protocol is mainly divided into three parts: data frame sending, data frame receiving and data frame processing.

3.1 Data frame transmission

When sending data, the request operation must be encapsulated into a standard MODBUS protocol frame to be successfully sent, that is, the encoding of the MODBUS protocol. As mentioned above, the data protocol unit PDU includes function codes and data codes. The encapsulation of PDU can be summarized as encapsulating the operation type and operation parameters as parameters into PDU. After constructing PDU, add the address of the slave to the header of the data frame, and then write the CR-C16 check value to the end of the data frame to form a complete application data unit ADU.

MODBUS uses CRC16 as a redundancy check. According to the cyclic redundancy check algorithm, a standard 16-bit generator polynomial can be used to check a 16-bit check code for any length of information field. The program flow can be described as follows:

(1) Initialize a 16-bit register and set all bits to 1.

(2) The 16-bit register is XORed with the data of the first byte in the data string to be verified, and the result is stored back in the register.

(3) The 16-bit register is shifted right by one bit.

(4) If the bit shifted right from the register is 1, XOR it with the check polynomial 0A001H. Otherwise, repeat step 3.

(5) Repeat steps 3 and 4 until all 8 bits of data of the Byte are processed.

(6) Take the next data in the data string and perform XOR operation on the 16-bit data, and store the result back into the register.

(7) Repeat steps 3 to 6 until all bytes in the data string to be verified have been processed.

(8) The data in the 16-bit register, i.e. the final check result of CRC16, is added to the end of the data frame.

Because the USART3 in the STM32F103ZET6 chip does not have the feature of hardware FIFO, it is necessary to use the queue data structure in the software as the sending buffer and receiving buffer to perform the serial port sending and receiving tasks. Therefore, in the working mode, the sending of USART3 adopts the query sending mode, and the data in the sending buffer is sent out in a cycle at one time, that is, the queue dequeue operation; and its receiving mode is interrupt mode. In the response function of each receiving interrupt of USART3, the software writes the data into the receiving buffer in chronological order, that is, the queue enqueue operation. [page]

3.2 Data frame reception

After sending the request frame, STM32F103ZET6 changes the RS485 bus from the sending state to the listening state through the GPIO operation of the receiving/transmitting enable terminal of the bus. During the listening process, STM32F1-03ZET6 completes the reception of the inverter F2000-G response frame.

Since the MODBUS RTU response frame judgment adopts the time stamp method, TM2 is used as a trigger for time management in this program. During the receiving process, USART3 resets TM2 every time it receives an interrupt to avoid the overflow interrupt of TIM2; and when the bus is idle for 3.5 characters of sending time, TM2 will generate an overflow interrupt due to the lack of USART3 reset, and complete the operation of closing USART3 to end data communication and setting the response frame reception completion flag in the interrupt response. This time stamping program is completed in the background interrupt, and the main program only needs to query the reception completion flag.

On the other hand, since the slave node F2000-G may have communication failures such as timeout and no response, the master node STM32F103ZET6 needs to perform timeout detection. In STM32F103ZE6, SysTick is a system timer that runs in the background after the chip is started, timing in ms and updating the system time in real time. Therefore, in the timeout judgment of MODBUS RTU, the main program can use this clock to cyclically query the current time and compare it with the starting time of sending the request frame. If the request frame is still not received within the threshold time of 200ms, it is considered that the communication has failed and the response timeout code is returned.

3.3 Data frame processing

On the basis of completing the correct reception of the data frame, the STM32F0103ZET6 must process the response frame, that is, decode the MODBUS protocol frame. The system reads the response frame from the receiving buffer. First, extract the ADU to determine the address code and CRC check code; secondly, extract the ADU from the PDU to determine the data length, function code, and data code; finally, if the check fails, the corresponding check failure code is returned. If the check succeeds, the data extracted from the ADU/PDU is processed to complete various functional operations of variable frequency speed regulation. Finally, the software flow of the entire protocol implementation is shown in Figure 3.

4 Embedded variable frequency speed regulation system

Using the MODBUS protocol, STM32F103ZET6 can implement variable frequency speed regulation functions according to the various functions provided by F2000-G, such as target frequency setting and variable frequency control. The addresses and parameter functions of common function commands are shown in Table 3.

In actual applications, STM32F103ZET6 realizes human-computer interaction through the HMI interface and realizes the variable frequency speed regulation operation of the AC motor according to the user input. For example, when starting the motor for non-destructive testing, the program writes the status word 0001H to the register at 2000H of F2000-G to start the motor forward. The communication record is as follows: the master node STM32F103ZET6 starts the inverter and sends: 01 06 20 00 00 01 43 CA; if the slave node F2000-G operates normally, it responds: 01 06 20 00 00 01 43 CA.

When the STM32F103ZET6 correctly reads the response frame and passes the verification, it can be determined that the inverter has successfully started the AC motor, and the mechanical test system starts running and gradually accelerates to the target speed.

5 Conclusion

The embedded system with STM32F103ZET6 as the core forms a network based on RS485 through MAX3485 and inverter F2000-G. The software part introduces the characteristics and composition of MODBUS protocol, analyzes the implementation principle of MODBUS protocol, and realizes the programming of this protocol in combination with the working characteristics of embedded system. The embedded software based on MODBUS protocol realizes the variable frequency speed control of electromechanical test device through communication with F2000-G. Practice shows that the system has reliable performance and stable communication, which meets the control requirements of variable frequency speed regulation of non-destructive flaw detection tester in the range of 40～1 400r·min-1.