Technical reference · Doc CP-MODBUS-RTU · Rev 1 · June 2026

CoolPro Modbus RTU Communications Protocol

Communication parameters, frame timing, RJ45 pinout and bus topology, supported function codes, the full register map, data encoding with worked CRC, and example transactions for integrating the AERL CoolPro into a Modbus RTU network over RS485.

1. Bus, connection & settings

The CoolPro provides access to real-time measurements and device information via the standard Modbus RTU protocol over RS485.

Communication parameters

Frame timing

Modbus RTU frames are delimited by idle time on the bus: a frame is treated as complete once the bus has been silent for the inter-frame gap period. The CoolPro uses a fixed inter-frame gap of approximately 8 ms, independent of the configured baud rate. This is comfortably wider than the 3.5-character silent interval required by the Modbus specification at every supported baud rate, so a standard-compliant master will interoperate without adjustment.

Physical connection (RJ45 pinout)

The CoolPro uses an 8-pin RJ45 connector for its RS485 interface (contacts numbered 1 to 8, left to right, viewed from the front). All other pins are unused.

Network topology

The Modbus network is a linear bus, with short stubs branching from ‘T’ connectors on the main backbone to each device. The data lines must be terminated at each end of the bus with a 120 Ω resistor between the RS485-A and RS485-B signals.

2. Supported function codes

0x03 Read Holding Registers

Read one or more configuration registers.

0x04 Read Input Registers

Read one or more input registers containing measurements or device information.

0x06 Write Single Register

Write a configuration register (device address, baud rate, or reset trigger).

3. Modbus register map

Addressing

Register reference numbers (4xxxx for holding registers, 3xxxx for input registers) are a documentation convention only. The value placed on the wire is the zero-based PDU address, shown in the Offset column — that is, on-wire address = reference number − 40001 (holding) or − 30001 (input) = the offset. Holding register 40001 is addressed on the wire as 0x0000 (function 0x03 / 0x06); input register 30001 is addressed on the wire as 0x0000 (function 0x04). The function code — not the reference range — selects the address space, so the same on-wire address 0x0000 reads the device address under 0x03 and the input voltage under 0x04.

Holding registers (FC 0x03, 0x06)

Configuration registers (read / write). All values are uint16.

Reset register read-back: register 40003 is a write-only command trigger. A read always returns 0 regardless of the value last written — this is expected behaviour, not a fault. The written value initiates the reset and is never stored.

Input registers (FC 0x04) — live telemetry (offsets 0–7)

All values are uint16 with milliunit scaling.

Status Flags bit field (register 30008)

A 16-bit bit field. Each bit reports a specific system condition and can be set or cleared independently.

Device information registers (offsets 100–107)

4. Data encoding

16-bit registers

Byte order is big-endian (MSB first). Example: value 24500 (0x5FB4) is transmitted as [0x5F, 0xB4].

Milliunit scaling

All measurements use milliunits so values carry as integers without floating point: voltage in millivolts (mV), current in milliamps (mA), temperature in millidegrees Celsius (m°C) — divide by 1000 for volts, amps or °C. For example, an input-voltage reading of 24500 is 24.5 V, and a temperature reading of 25800 is 25.8 °C.

32-bit values

Uptime, serial number and manufacture date span two uint16 registers: low word first, high word second, big-endian within each register. Reconstruct with (high << 16) | low. Example — value 70000 (0x00011170) is stored as register N (low) = 0x1170 (4464), register N+1 (high) = 0x0001 (1). All values are transmitted as integers; no floating-point encoding is used.

CRC-16

Every frame ends with a 16-bit CRC computed over all preceding bytes using polynomial 0xA001 with an initial value of 0xFFFF, and transmitted low byte first.

5. Exception codes

Standard Modbus exception responses. Exception response frame: [Device ID] [Function Code + 0x80] [Exception Code] [CRC Lo] [CRC Hi]

6. Example transactions

All requests are addressed to device ID 0x28 (40). CRC bytes are shown as [CRC]; worked CRC values are given in §4 Data encoding.

Telemetry & identity

Configuration writes

7. Revision history