Modbus RTU Intelligent Wireless Sensor Gateway Protocol Manual - Register Mapping Table and Communication Frame Format - Modbus Product Center

I. Product Overview

This product is a smart wireless sensor gateway device that supports the standardModbus RTU protocolof AndIntelligent wireless sensor gateway deviceand hasmulti node sensor data acquisition, communication parameter configurationSecondlydevice management function. Communication with upper computer (PLC, touch screen, SCADA system, etc.) through RS485 interface, supporting complete register read and write operations, can be widely used inindustrial automation, environmental monitoring, Smart Agriculture, Livestock Farming, Building Securityand other fields. As the core hub of wireless sensor networks, this gateway can manage up to 64 wireless sensor nodes simultaneously, converting the data from each sensor into the standard Modbus RTU protocol format for easy integration with the upper computer system.

As the core hub of wireless sensor networks, this gateway can manage up to64 wireless sensor nodesConvert the data from each sensor into a standard Modbus RTU protocol format for easy integration into the upper computer system.

II. Overview of Core Functional System (Calculated from Protocol)

Based on the register definitions, operation cases, and data structures in this protocol document, the following functional modules of the product can be fully calculated:

III. Detailed Explanation of Supported Sensor Types

According to the encoding definition of the low 8 bits (sensor type field) of the Index register in the protocol, the gateway supports the following7 sensor types, and can be extended more:

3.1 Sensor Type Encoding Table

3.2 Detailed Description of Data Formats for Each Sensor

① Temperature and Humidity Sensor (Type=01H)

② Ear Tag Sensor - Livestock Breeding Specific (Type=02H)

A wireless ear tag sensor designed specifically for livestock such as cattle, sheep, and pigs, which is a major feature of this product.

③ Smoke/Smoke Sensor (Type=03H)

④ Radar human presence sensor (Type=04H)&infrared PIR sensor (Type=05H)

Both types of sensors are used for human presence detection, but their technical principles are different:

⑤ Wireless Remote Control (Type=06H)&Universal 1527 Encoding Device (Type=00H)

4, Communication Parameters and Frame Format Specification

4.1 Basic Communication Parameters

4.2 Baud Rate Configuration Comparison Table (0004H Register)

4.3 supported function code

5, Complete Register Mapping Table

5.1 System Control Register Area (0001H~000FH)

5.2 Sensor Data Register Area (Starting from 0010H)

Each sensor occupies6 consecutive registers (12 bytes)Supports up to 64 sensors:

VI. Detailed explanation of working mode

6.1 Dual data reporting mode

The gateway supports two data reporting modes, which can be switched through the 0005H register:

Mode 0: Active reporting mode (default)

• After wireless sensors detect data changes,automatically uploads the data to the gateway
• . The gateway updates the internal register cache immediately after receiving it
• . The upper computer can read the latest data at any time through the 0x03 function code.
• Advantages:Good real-time performance, sensor side actively pushes, data updates in a timely manner
• Applicable scenarios: scenarios that requirereal-time monitoring(such as temperature limit alarm, personnel intrusion detection, etc.)

Mode 1: Query Reporting Mode

• Wireless sensors are only available inWhen receiving a gateway query commandOnly returned data
• The upper computer initiates a read request → the gateway queries the sensor → returns data
• Advantages:power savingThe sensor is mostly in a dormant state for most of the time
• Applicable scenarios:battery poweredSensors, low-power priority scenarios (such as remote monitoring in agriculture)

6.2 Binding and pairing process

Before adding wireless sensors to the gateway, the binding and pairing operation must be completed first. SupportTwo triggering methods:

Method 1: Software instruction binding (written to 0006H via Modbus)

1. The upper computer writes values to the 0006H register1Send 01 06 00 06 00 01 A8 0B
2. The gateway enters binding mode,The indicator light starts flashing
3. Enable wireless sensors for the targetSend data once(or trigger its emission signal)
4. The gateway receives and recognizes sensor signals,Automatically allocate a free storage slotRecord the sensor address
5. Binding successful: The indicator light stops flashing, and the gateway returns a response of 01 06 00 06 00 01 A8 0B (success code 1)
6. If no sensor signal is received within 20 seconds, return timeout response 01 06 00 06 00 02 E8 0A (timeout code 2), exit binding mode

Method 2: Hardware key binding

1. Long press the pairing button on the gateway panel for 5 seconds
2. Enter binding mode (with exactly the same effect as software instructions)
3. The subsequent steps are the same as Method 1

7, Complete operation case (10 instances including byte by byte parsing)

The following provides a complete operation example covering all functions, including hexadecimal request/response frames and field by field parsing.

7.1 System Register Operations (6 Examples)

Case 1: Read Device Firmware Version Number (Read 0001H)

Case 2: Read the current number of online sensor nodes (read 0002H)

Case 3: Modify the RS485 slave address of the device (write 0003H → new address=2)

Case 4: Modify the serial port baud rate to 19200 (write 0004H → value=1)

Case 5: Switch to query reporting mode (write 0005H → value=1)

Case 6: Start sensor binding pairing (write 0006H → value=1)

7.2 Sensor data register operation (4 examples)

Case 7: Manually adding sensor 1 to the system (write address 0x12345678)

When the 32-bit address of the sensor device is known, it can be directly added to the system through register writing:

Case 8: Read all data from sensor 1 (6 registers=12 bytes)

Case 9: Delete Sensor 1 (Clear Address Register)

The method to delete sensors is to reset all corresponding address registers to zero:

Case 10: Directly writing temperature and humidity data from sensor 1

8. Exception handling When the slave station detects an illegal operation, it returns an abnormal response:

8.1 Modbus Exception Response Format

When an illegal operation is detected by the slave station, an abnormal response is returned:

• The highest bit of the normal function code becomes 1 (such as 0x03 → 0x83, 0x06 → 0x86, 0x10 → 0x90)
• followed by a 1-byte exception code

8.2 Binding function return code (0006H register)

8.3 Fault diagnosis checklist

9. Precautions and best practices

9.1 Key precautions

1. Frame interval timemust be maintained between adjacent frames. BI_659] 3.5 character time3.5 character timeThe silence interval. Shortest frame interval at different baud rates:
   • 9600 bps: approximately 3.6 ms
   • 115200 bps: approximately 0.3 ms
2. Big-endian byte orderWhen using function code 0x10 to write multiple registers, data must be written according toBig End ModeOrganization, high bytes come first and low bytes come last.
3. Broadcast operation no response: When sending a command to the broadcast address 0xFF, all slave stations perform the operation butdoes not return a response frame.
4. Sensor addition rule: When adding a sensor, the address register (Addr_H+Addr_L) must be writtenNon zero value; Writing all zeros is equivalent to deleting the node.
5. Operation Interval: After updating sensor data, wait for at least100msbefore performing the next register operation.
6. Risk of clearing binding: Writing to the 0007H register willclear all bound sensor data at once. Before operation, please confirm that there is no need to retain the existing configuration. After clearing, you need to rebind one by one.

9.2 Recommended Operating Procedure

1. First Power On: Read 0001H to confirm firmware version, read 0002H to confirm initial state
2. Configure communication parameters: Modify 0003H (address), 0004H (baud rate), 0005H (reporting mode) as needed
3. Bind sensors: Add sensors one by one by pressing 0006H or physically
4. Verify binding: Read 0002H to confirm node number, read corresponding sensor data area to confirm data is normal
5. Daily operation and maintenance: Regularly read sensor Battery field to monitor battery level and replace low battery sensor batteries in a timely manner

Implement CRC16 algorithm

This protocol adoptsMODBUS standard CRC16verification algorithm, polynomial0xA001(i.e. bit reversed form of 0x8005). The following is a complete C language reference implementation:

#include <stdint.h>

/**
 * MODBUS CRC16 计算
 * @param data  待计算的数据缓冲区指针
 * @param len   数据长度（字节）
 * @return      16 位 CRC 校验值（低字节在前）
 *
 * 多项式：0xA001（MODBUS 标准）
 * 初始值：0xFFFF
 */
uint16_t calc_crc(uint8_t *data, uint16_t len)
{
    uint16_t crc = 0xFFFF;          // 初始值
    for (uint16_t i = 0; i < len; i++)
    {
        crc ^= data[i];              // 与当前字节异或
        for (uint8_t j = 0; j < 8; j++)  // 逐位处理
        {
            if (crc & 0x0001)       // 最低位为 1
            {
                crc >>= 1;           // 右移一位
                crc ^= 0xA001;       // 与多项式异或
            }
            else
            {
                crc >>= 1;           // 仅右移
            }
        }
    }
    return crc;
}

/* 使用示例：
 * uint8_t frame[] = {0x01, 0x03, 0x00, 0x01, 0x00, 0x01};
 * uint16_t crc = calc_crc(frame, 6);
 * 结果：crc = 0xCAD5（低字节 0xD5 在前，高字节 0xCA 在后）
 */

11. Data Download and Technical Support

• This document version:V1.3(Updated on October 3, 2025)
• Protocol follows standards:Modbus Industrial Standard Protocol Specification
• The specific register definition shall be based on the actual firmware of the device
• If you need technical support, please contact the manufacturer for the latest register mapping table and protocol documentation

Version iteration history

12, Typical application scenarios

Scenario 1: Smart Agriculture - Greenhouse Environment Monitoring System

Deploy inside the greenhouseTemperature and humidity sensor (Type=01H)aggregates data through this gateway and uploads it to the PLC or touch screen control system via Modbus RTU. It can be linked with ventilation fans, sprinkler systems, sunshades and other equipment to achieve automatic temperature and humidity control. Supports up to 64 sensor points64 sensor pointsMeet the multi-point monitoring needs of large connected greenhouses.

Scenario 2: Smart Livestock - Livestock Health Management

Wear for each cow/sheepWireless Ear Tag Sensor (Type=02H)The gateway collects temperature and activity data of livestock in a centralized manner. When the body temperature of a certain livestock exceeds the set threshold, an automatic alarm (disease warning) will be triggered, or when there is an abnormal change in activity, the estrus/health status will be determined.64 node capacityCapable of covering the livestock management needs of small and medium-sized farms.

Scenario 3: Fire Safety - Warehouse/Computer Room Fireworks Monitoring

DeploymentSmoke sensor (Type=03H)Real time monitoring of smoke concentration in key areas such as warehouses and computer rooms. When the concentration exceeds the threshold, the Modbus upper computer triggers the sound and light alarm, exhaust system, or notifies the fire linkage platform. Combined with temperature and humidity sensors, comprehensive environmental safety monitoring can also be achieved.

Scenario 4: Intelligent Building - Human Presence Perception and Lighting Linkage

Install in offices, conference rooms, and bathroomsRadar sensor (Type=04H)orInfrared PIR sensor (Type=05H)To achieve precise personnel presence detection. The radar scheme can detect micro movements (even breathing), achieving true“People are about to light upIntelligent lighting control greatly saves energy. Sensor data is connected to the Building Automation System (BAS) or KNX/Modbus bus through a gateway.

Scenario 5: Security Alarm - Intrusion Detection and Wireless Remote Control

CombineInfrared sensor (Type=05H)Implement perimeter intrusion detection, combined withWireless remote control (Type=06H)Used for arming/disarming operations.Universal 1527 device (Type=00H)Compatible with various wireless detectors such as door magnets, glass breakage, and water immersion, a complete wireless security system is built, and all data is uniformly connected to the alarm host or SCADA platform through Modbus RTU.