Modbus Register Definitions

Modbus Register Definitions

Common Modbus Function Codes

Input registers and holding registers can be read and written using the above commands.

Modbus Exception Codes

Sensor Data Reading Example

Function: Read the current PM1.0, PM2.5 and PM10 particulate concentration values detected by the BMV080 sensor via the Modbus RTU protocol.

Hardware Preparation

TEL0190 RainbowLink V2 ×1

SEN0662 Gravity: BMV080 PM2.5 Sensor ×1

Wiring Diagram

Connection Description:

• Sensor DIP switch configuration: Set the communication mode to UART side (the factory default UART address is 0x57).

General Operation Procedure

Parameter configuration: Configure settings in the serial debugging tool to match the sensor:

• Baud rate: 9600 (default)
• Data bits: 8
• Stop bit: 1
• Parity: None

Important Precondition: The sensor does not automatically start measurement after power-up. The start-measurement command must be sent first for the PM concentration registers to refresh with valid data.

Enter the hexadecimal command below in the transmit pane of the debugging tool, enable hex transmit, then send.

Start Measurement Command & Parsing

Full transmit frame: 57 06 00 03 00 01 B4 3C

Response Data & Parsing

The sensor replies with the following frame upon receiving the command:

Full response frame: 57 06 00 03 00 01 B4 3C

A response identical to the transmit frame indicates successful measurement start. After waiting several milliseconds, PM concentration data can be read.

PM Concentration Read Command & Parsing

Send the PM concentration read command:

Full transmit frame: 57 04 00 06 00 06 9C 3F

Response Data & Parsing

Sample response frame returned by the sensor:

Full response frame: 57 04 0C 40 E0 00 00 41 80 00 00 41 B8 00 00 C5 58

Data Parsing Steps

The raw response payload is 12 bytes, divided into 3 groups of 4 bytes each (2 × 16-bit registers, big-endian).

Physical quantity conversion is already completed inside the sensor firmware. The two 16-bit Modbus registers returned hold the high/low fragments of a 32-bit IEEE‑754 single-precision float. No additional multiplication or scaling factors are required.

Concatenate the high word and low word in big-endian order to form the 32-bit raw bit value:

floatRaw = ((uint32_t)high_word << 16) | low_word;

Interpret the bit pattern of floatRaw directly as an IEEE‑754 single-precision float. The resulting value is particulate concentration in μg/m³.

Example

• PM1.0: high word = 0x40E0, low word = 0x0000floatRaw = (0x40E0 << 16) | 0x0000 = 0x40E00000 Interpreted per IEEE‑754 → 7.0 μg/m³
• PM2.5: high word = 0x4180, low word = 0x0000floatRaw = (0x4180 << 16) | 0x0000 = 0x41800000 Interpreted per IEEE‑754 → 16.0 μg/m³
• PM10: high word = 0x41B8, low word = 0x0000floatRaw = (0x41B8 << 16) | 0x0000 = 0x41B80000 Interpreted per IEEE‑754 → 23.0 μg/m³

Result Interpretation

The sample readings represent low particulate concentration in ambient air, typical output for a clean environment.

If NaN / Inf is returned, read the status flag input register 0x000E. When BIT9 (VALUE_INVALID) is set, the floating-point data is invalid.

Rationale

Digital output: The firmware encodes concentration values from the Bosch BMV080 chip into 32-bit IEEE‑754 single-precision floats, then splits each float across two 16-bit Modbus registers for output.

Big-endian ordering: Modbus register transmission uses big-endian format; the high 16-bit register precedes the low 16-bit register. The order must not be swapped during reconstruction. Unit: Parsing yields values directly in μg/m³ with no further scaling required.

Notes

• No automatic measurement after power-up: The start-measurement command 06 00 03 00 01 must be sent after every power cycle. PM-related input registers will continuously refresh only after this command; PM registers hold stale values or zero before measurement starts.
• Configuration changes (algorithm, blockage detection, integration time, duty-cycle period) can be written directly to holding registers and saved into NVS. However, updated parameters are only downloaded to the sensor chip and take effect upon the next start-measurement command.
• PID / VID, version and operating status registers are readable immediately after power-up; measurement start command is not required.
• CRC checksum in response frames can be used to verify transmission integrity.
• For continuous reading: after measurement starts, repeatedly issue Read Input Register commands to retrieve the latest samples.
• Full-scale PM range: up to 1000 μg/m³. When BIT1 of register 0x000E is asserted, PM2.5 exceeds the measurement range.

Modbus RTU Scan for Unknown Slave Address

Function: When the Modbus RTU slave address of the sensor is forgotten, scan devices on the bus via a serial debugging tool to retrieve the actual slave address of the BMV080 sensor.

Hardware Required

TEL0190 RainbowLink V2 ×1

SEN0662 Gravity: BMV080 PM2.5 Sensor ×1

Wiring Diagram

Connection Description:

• Sensor DIP switch configuration: Set the communication mode to UART side (the factory default UART address is 0x57).

General Operation Procedure

Parameter configuration: Configure settings in the serial debugging tool to match the sensor:

• Baud rate: 9600 (default)
• Data bits: 8
• Stop bit: 1
• Parity: None

Note: This function is a custom firmware extension. It works only when exactly one BMV080 sensor is connected to the bus. Do not use this command if two or more Modbus devices reside on the bus, as it will cause bus message collision.

Command Transmission & Parsing (Single Sensor on Bus Only)

Full transmit frame: 00 03 00 00 00 01 85 DB

Response Data & Parsing (Example, actual device address = 0x57)

Full response frame: 57 03 02 00 57 B1 B6

Result Interpretation

The returned register value 0x0057 indicates the current Modbus slave address of the sensor is 0x57.

Rationale

The standard Modbus‑RTU specification permits only write commands for broadcast addresses; read commands shall not generate a response. This sensor firmware implements a private extension: when only one device exists on the bus, a broadcast read of holding register 0x0000 returns the local address to simplify user debugging.

Notes

• The bus must contain only one BMV080 sensor. In multi-device scenarios, this command triggers simultaneous responses from multiple devices, causing bus collision, garbled data, and unidentifiable addresses. For multi-device buses, use the standard scanning method: iterate addresses from 0x01 to 0xF7 and read the PID input register.

• This command reads holding register 0x0000 (device address configuration register), not the PID. The PID is located in input register 0x0000 and is read with function code 04.

• If the baud rate has been modified, this broadcast command will return no response. Switch to the correct baud rate before use.

• This private extension is firmware-specific to this sensor. Other vendors’ Modbus sensors do not support this method; do not port this command to other hardware.