84
Chapter 6. Serial I/O, SNP & RTU Protocols
GFK-2222W
August 2015
165
6.3.2
Cyclic Redundancy Check (CRC)
The CRC is one of the most effective systems for checking errors. The CRC consists of two check
characters generated at the transmitter and added at the end of the transmitted data characters.
Using the same method, the receiver generates its own CRC for the incoming data and compares it
to the CRC sent by the transmitter to ensure proper transmission. A complete mathematic derivation
for the CRC is not given in this section. This information can be found in a number of texts on data
communications. The essential steps that should be understood in calculating the CRC are as follows:
■
The number of bits in the CRC multiplies the data bits that make up the message.
■
The resulting product is then divided by the generating polynomial (using modulo 2 with no
carries). The CRC is the remainder of this division.
■
Disregard the quotient and add the remainder (CRC) to the data bits and transmit the message
with CRC.
■
The receiver then divides the message plus CRC by the generating polynomial and if the
remainder is 0, the transmission was transmitted without error.
A generating polynomial is expressed algebraically as a string of terms in powers of X such as
X
3
+ X
2
+ X
0
(or 1)
which, in turn, can be expressed as the binary number 1101.
A generating polynomial could be any length and contain any pattern of 1s and 0s as long as both
the transmitter and receiver use the same value. For optimum error detection, however, certain
standard generating polynomials have been developed. RTU protocol uses the polynomial
X
16
+ X
15
+ X
2
+ 1
which in binary is 1 1000 0000 0000 0101. The CRC this polynomial generates is known as CRC-16.
The discussion above can be implemented in hardware or software. One hardware implementation
involves constructing a multi-section shift register based on the generating polynomial.
6.3.2.1
Cyclic Redundancy Check Register
13
12
11
10
9
8
7
6
5
4
3
2
1
0
15
14
+
+
+
+
Data
Input
CRC Register
= Exclusive Or
X
2
X
15
X
16
Figure 28: CRC Register Operation
To generate the CRC, the message data bits are fed to the shift register one at a time. The CRC
register contains a preset value. As each data bit is presented to the shift register, the bits are shifted
to the right. The LSB is XORed with the data bit and the result is: XORed with the old contents of bit 1
(the result placed in bit 0), XORed with the old contents of bit 14 (and the result placed in bit 13), and
finally, it is shifted into bit 15. This process is repeated until all data bits in a message have been
processed. Software implementation of the CRC-16 is explained in the section below.
46
Chapter 6. Serial I/O, SNP & RTU Protocols
166
PACSystems* RX7i & RX3i CPU Reference Manual
GFK-2222W
6.3.2.2
Calculating the CRC-16
The pseudo code for calculation of the CRC-16 is given below.
Preset byte count for data to be sent.
Initialize the 16-bit remainder (CRC) register to all ones.
XOR the first 8-bit data byte with the high order byte of the 16-bit CRC register. The
result is the current CRC.
INIT SHIFT:
Initialize the shift counter to 0.
SHIFT:
Shift the current CRC register 1 bit to the right.
Increment shift count.
Is the bit shifted out to the right (flag) a 1 or a 0?
If it is a 1, XOR the generating polynomial with the current CRC.
If it is a 0, continue.
Is shift counter equal to 8?
If NO, return to SHIFT.
If YES, increment byte count.
Is byte count greater than the data length?
If NO, XOR the next 8-bit data byte with the current CRC and go to INIT SHIFT.
If YES, add current CRC to end of data message for transmission and exit.
When the message is transmitted, the receiver performs the same CRC operation on all the data bits
and the transmitted CRC. If the information is received correctly the resulting remainder (receiver
CRC) is 0.
Sample CRC-16 Calculation
The RTU device transmits the rightmost byte (of registers or discrete data) first. The first bit of the
CRC-16 transmitted is the MSB. Therefore, in the example the MSB of the CRC polynomial is to the
extreme right. The X
16
term is dropped because it affects only the quotient (which is discarded) and
not the remainder (the CRC characters). The generating polynomial is therefore 1010 0000 0000
0001. The remainder is initialized to all 1s.
In this example, the CRC-16 is calculated for RTU message, Read Exception Status 07. The message
format is as follows:
Address
Function
CRC-16
01
07
In this example, device number 1 (address 01) is queried. You need to know the amount of data to be
transmitted and this information can be found for every message type in Calculating the Length of
Frame. For this message the data length is 2 bytes.
183
Chapter 6. Serial I/O, SNP & RTU Protocols
GFK-2222W
August 2015
167
Transmitter CRC-16 Algorithm
Receiver
39
CRC-16 Algorithm
MSB
40
LSB
40
Flag
MSB
40
LSB
40
Flag
Initial Remainder
1111
1111 1111 1111
Rcvr CRC after data
1110 0010 0100 0001
XOR 1st data byte 0000
0000 0000 0001
XOR 1st byte Trns CRC 0000 0000 0100 0001
Current CRC
1111
1111 1111 1111
Current CRC
1110 0010 0000 0000
Shift 1
0111
1111 1111 1111 0
Shift 1
0111 0001 0000 0000
0
Shift 2
0011
1111 1111 1111 1
Shift 2
0011 1000 1000 0000
0
XOR Gen. Polynomial 1010
0000 0000 0001
Shift 3
0001 1100 0100 0000
0
Current CRC
1001
1111 1111 1110
Shift 4
0000 1110 0010 0000
0
Shift 3
0100
1111 1111 1111 0
Shift 5
0000 0111 0001 0000
0
Shift 4
0010
0111 1111 1111 1
Shift 6
0000 0011 1000 1000
0
XOR Gen. Polynomial 1010
0000 0000 0001
Shift 7
0000 0001 1100 0100
0
Current CRC
1000
0111 1111 1110
Shift 8
0000 0000 1110 0010
0
Shift 5
0100
0011 1111 1111 0
XOR 2nd byte Trns CRC 0000 0000 1110 0010
Shift 6
0010
0001 1111 1111 1
Current CRC
0000 0000 0000 0000
XOR Gen. Polynomial 1010
0000 0000 0001
Shift 1-8 yields
0000 0000 0000 0000
Current CRC
1000
0001 1111 1110
All errors for receiver final CRC-16 indicates transmission correct.
Shift 7
0100
0000 1111 1111 0
Shift 8
0010
0000 0111 1111 1
XOR Gen. Polynomial 1010
0000 0000 0001
Current CRC
1000
0000 0111 1110
XOR 2nd data byte 0000
0000 0000 0111
Current CRC
1000
0000 0111 1001
Shift 1
0100
0000 0011 1100 1
XOR Gen. Polynomial 1010
0000 0000 0001
Current CRC
1110
0000 0011 1101
Shift 2
0111
0000 0001 1110 1
XOR Gen. Polynomial 1010
0000 0000 0001
Current CRC
1101
0000 0001 1111
Shift 3
0110
1000 0000 1111 1
XOR Gen. Polynomial 1010
0000 0000 0001
Current CRC
1100
1000 0000 1110
Shift 4
0110
0100 0000 0111 0
Shift 5
0011
0010 0000 0011 1
XOR Gen. Polynomial 1010
0000 0000 0001
Current CRC
1001
0010 0000 0010
Shift 6
0100
1001 0000 0001 0
Shift 7
0010
0100 1000 0000 1
XOR Gen. Polynomial 1010
0000 0000 0001
Current CRC
1000
0100 1000 0001
Shift 8
0100
0010 0100 0000 1
XOR Gen. Polynomial 1010
0000 0000 0001
Transmitted CRC
1110
0010 0100 0001
E
2
4
1
39
The receiver processes incoming data through the same CRC algorithm as the transmitter. The example for the receiver
starts at the point after all the data bits but not the transmitted CRC have been received correctly. Therefore, the receiver
CRC should be equal to the transmitted CRC at this point. When this occurs, the output of the CRC algorithm will be zero
indicating that the transmission is correct.
The transmitted message with CRC would then be:
Address Function
CRC–16
01
07
41
E2
40
The MSB and LSB references are to the data bytes only, not to the CRC bytes. The CRC MSB and LSB order are the reverse
of the data byte order.
98
Chapter 6. Serial I/O, SNP & RTU Protocols
168
PACSystems* RX7i & RX3i CPU Reference Manual
GFK-2222W
6.3.2.3
Calculating the Length of Frame
To generate the CRC-16 for any message, the message length must be known. The length for all
types of messages can be determined from the table below.
6.3.2.4
RTU Message Length
Function
Code
Name
Query or Broadcast Message Length
Less CRC Code
Response Message Length
Less CRC Code
0
Not Defined
Not Defined
1
Read Output Table
6
3 + 3rd byte
41
2
Read Input Table
6
3 + 3rd byte
41
3
Read Registers
6
3 + 3rd byte41
4
Read Analog Input
6
3 + 3rd byte
41
5
Force Single Output
6
6
6
Preset Single Register
6
6
7
Read Exception Status
2
3
8
Loopback/Maintenance
6
6
9-14
Not Defined
Not Defined
15
Force Multiple Outputs
7 + 7th byte
41
6
16
Preset Multiple Registers
7 + 7th byte41
6
17
Report Device Type
2
8
18-21
Not Defined
Not Defined
22
Mask Write 4x Registers
8
8
23
Read/Write 4x Registers
13+byte 1141
5+byte 341
24–66
Not Defined
Not Defined
67
Read Scratch Pad
6
3 + 3rd byte
41
68-127
Not Defined
Not Defined
128-255
Not Defined
3
41
The value of this byte is the number of bytes contained in the data being transmitted.
60
Chapter 6. Serial I/O, SNP & RTU Protocols
GFK-2222W
August 2015
169
6.3.3
RTU Message Descriptions
This section presents the format and fields for each RTU message.
6.3.3.1
Message (01): Read Output Table
Format:
Address
Starting
Point No.
Number of
Points
Error
Check
Func
01
Query
Hi
Hi
Lo
Lo
Address
Data
Error
Check
Func
01
Normal Response
Byte
Count
Figure 29: RTU Read Output Table Message Format
Query:
An address of 0 is not allowed because this cannot be a broadcast request.
The function code is 01.
The starting point number is two bytes in length and may be any value less than the highest
output point number available in the attached CPU. The starting point number is equal to one
less than the number of the first output point returned in the normal response to this request.
The number of points value is two bytes in length. It specifies the number of output points
returned in the normal response. The sum of the starting point value and the number of points
value must be less than or equal to the highest output point number available in the attached
CPU. The high order byte of the Starting Point Number and Number of Points fields is sent as the
first byte. The low order byte is the second byte in each of these fields.
Response:
The byte count is a binary number from 1 to 256 (0 = 256). It is the number of bytes in the normal
response following the byte count and preceding the error check.
The Data field of the normal response is packed output status data. Each byte contains eight
output point values. The least significant bit (LSB) of the first byte contains the value of the output
point whose number is equal to the starting point number plus one. The values of the output
points are ordered by number starting with the LSB of the first byte of the Data field and ending
with the most significant bit (MSB) of the last byte of the Data field. If the number of points is not a
multiple of 8, the last data byte contains zeroes in one to seven of its highest order bits.
57
Chapter 6. Serial I/O, SNP & RTU Protocols
170
PACSystems* RX7i & RX3i CPU Reference Manual
GFK-2222W
6.3.3.2
Message (02): Read Input Table
Format:
Address
Starting
Point No.
Number of
Points
Error
Check
Func
02
Query
Hi
Hi
Lo
Lo
Address
Data
Error
Check
Func
02
Normal Response
Byte
Count
Figure 30: RTU Read Input Table Message Format
Query:
An address of 0 is not allowed as this cannot be a broadcast request.
The function code is 02.
The starting point number is two bytes in length and may be any value less than the highest
input point number available in the attached CPU. The starting point number is equal to one less
than the number of the first input point returned in the normal response to this request.
The number of points value is two bytes in length. It specifies the number of input points returned
in the normal response. The sum of the starting point value and the number of points value must
be less than or equal to the highest input point number available in the attached CPU. The high
order byte of the Starting Point Number and Number Of Bytes fields is sent as the first byte. The
low order byte is the second byte in each of these fields.
Response:
The byte count is a binary number from 1 to 256 (0 = 256). It is the number of bytes in the normal
response following the byte count and preceding the error check.
The Data field of the normal response is packed input status data. Each byte contains eight input
point values. The least significant bit (LSB) of the first byte contains the value of the input point
whose number is equal to the starting point number plus one. The values of the input points are
ordered by number starting with the LSB of the first byte of the Data field and ending with the
most significant bit (MSB) of the last byte of the Data field. If the number of points is not a multiple
of 8, then the last data byte contains zeroes in one to seven of its highest order bits.
63
Chapter 6. Serial I/O, SNP & RTU Protocols
GFK-2222W
August 2015
171
6.3.3.3
Message (03): Read Registers
Format:
Address
Starting
Register No.
Number of
Registers
s
Error
Check
Func
03
Query
Hi
Hi
Lo
Lo
Address
Data
Error
Check
Func
03
Normal Response
Byte
Count
First Register
Hi
Hi
Lo
Lo
Figure 31: RTU Read Registers Message Format
Query:
An address of 0 is not allowed as this request cannot be a broadcast request.
The function code is equal to 3.
The starting register number is two bytes in length. The starting register number may be any
value less than the highest register number available in the attached CPU. It is equal to one less
than the number of the first register returned in the normal response to this request.
The number of registers value is two bytes in length. It must contain a value from 1 to 125
inclusive. The sum of the starting register value and the number of registers value must be less
than or equal to the highest register number available in the attached CPU. The high order byte
of the Starting Register Number and Number of Registers fields is sent as the first byte in each of
these fields. The low order byte is the second byte in each of these fields.
Response:
The byte count is a binary number from 2 to 250 inclusive. It is the number of bytes in the normal
response following the byte count and preceding the error check. Note that the byte count is
equal to two times the number of registers returned in the response. A maximum of 250 bytes
(125) registers is set so that the entire response can fit into one 256 byte data block.
The registers are returned in the Data field in order of number with the lowest number register in
the first two bytes and the highest number register in the last two bytes of the Data field. The
number of the first register in the Data field is equal to the Starting Register Number plus one.
The high order byte is sent before the low order byte of each register.
Documents you may be interested
Documents you may be interested
