RS485 bus scan

In electronics, there are many wired, half-duplex, asynchronous, serial bus interfaces. These are 1-Wire, RS485, 10BASE2(thin Ethernet), LIN, K-Line , CAN, I2C, MIL-STD-1553, ARINC 429.

In all these shared-bus interfaces, one way or another, the task of scanning the bus arises.

Anyone who has worked with i2c knows the bus scan procedure. There you can simply brute-force scan the bus. Since the address length is only 7 bits, you can scan the bus in just a couple of seconds.

In CAN, the task of scanning is not worth it at all, since there collisions are resolved at the hardware level of physical transceivers or even MAC peripherals. In CAN, it is enough to connect anywhere and in a moment it will be clear in the CAN-Hacker utility who lives there on the CAN bus. In CAN, all nodes are constantly flood(dyat) “Hello!” packages.

In Lin, the node network is usually completely 100% static and is flashed during production. This is understandable, because a new button will not appear in the car door while driving. A new handrail with a stop button will not grow in the bus cabin along the route.

I honestly don’t know how things are with scanning in other wired interfaces: 1-Wire, 10BASE2(thin Ethernet), K-Line, MIL-STD-1553, ARINC 429. If anyone is in the subject, please write in the comments.

What does an RS485 network usually look like?

What is the difficulty of scanning the RS485 bus?

1–The difficulty is that RS485 device addresses have a significantly higher bit length, usually 32 bits (4 bytes) or MAC addresses of 48 bits (6 bytes). Suppose the nodes on the RS485 bus have a 32-bit address, and if you scan the RS485 bus as in I2C, then the Chinese calculator will show that you have to “wait and be patient” for 14 years!

2–The RS485 bus does not have a collision resolution mechanism like CAN(y). If 2 nodes start transmitting at the same time, then the data in the twisted pair will be distorted and the master will read the garbage packet with a damaged checksum.

3–All devices on the RS485 bus can generally operate at different bit rates 110, 300, 600, 1200, 2400, 4800, 9600, 14400, 19200, 38400, 57600, 115200, 230400, 460800, 921600 bps c. I worked in three offices and each had its own standard bit rate of the RS485 bus. And everyone is different! If a device is running at a bit rate of 460800 bps then it will not respond to packets that are sent to it at a bit rate of 115200 bps.

How to scan the RS485 bus?

Before proceeding to explain the essence of the RS485 bus scanning algorithm, I would like to give an analogy from life. This analogy is about how bugbears use picklocks to break padlocks. The first master key creates a moment of force that fixes the position of one of the pins. Then, with the second master key, they find a pin that moves tightly and slowly and carefully select the position of the resting pin until they hear a quiet click. The first lockpick will tremble. Then another pin begins to rest. Similarly, move the next pin to the same click. And so on until all the pins are exactly in the right position. Then the lock will open.

Here the situation is similar. Instead of pins – bits, instead of a click – a confirmation signal.

Before moving on, we need to agree on terminology.

Terminology

–Device address – this is either a MAC address, a serial number (SN), or an analogue of an IP address or any other ID (shnik) unique for each device instance on the RS485 bus. The moment that the address is wide, many bits is important. Let it be, for example, a 32-bit address.

–Address mask is the part of the device address that starts at the least significant bit of the LSB and increases towards the most significant bit. It makes sense to expand the mask from the lower bits, because all addresses have lower bits, but there may not be higher single bits. Here is an example of several real masks:

No.	Address mask example	mask length, [бит]
1	xxxx_xxxx_xxxx_xxxx_xxxx_xxxx_xxxx_xxxx	0
2	xxxx_xxxx_xxxx_xxxx_xxxx_xxxx_xxxx_xxx0	1
3	xxxx_xxxx_xxxx_xxxx_xxxx_xxxx_xxxx_xx00	2
4	xxxx_xxxx_xxxx_xxxx_xxxx_xxxx_xxxx_xx01	2
5	1000_0100_0000_1111_1111_0001_1101_0011	32
6	xxxx_xxxx_xxxx_xxxx_xxxx_xxxx_xxxx_xx10	2
7	xxxx_xxxx_xxxx_xxxx_xxxx_xxxx_xx10_1110	6

–Confirmation signal– this is when the slave device on RS485 takes the UART_TX pin, puts it in GPIO PUSH-PULL mode, sets it to 0V, waits for T_ack seconds (for example 10ms) and then reconnects the controller to the UART_TX pin. All this is called a confirmation signal. In fact, the device temporarily presses the bus to zero volts. At the same time, it is absolutely not dangerous if several devices simultaneously press the bus to zero. The effect will be like from one. That is, a logical OR is obtained. The master will have 0V on UART_RX.

–mute package – this is such a binary packet, having received which the slave device stops sending anything to the common RS485 bus and will not even emit signals. The device will only listen to the bus. Mute package may contain an option to enable or disable Mute mode.

Verbal description of the RS485 bus scanning algorithm

1–The master device announces that all slave devices are now entering scan mode.

2–the master sends an address mask, for example Mx=xx…xx0 or Mx1=xx…xx1 and asks those devices whose address matches the mask to respond. That is, whose zero bit is zero.

3–the master translates the UART_RX pin to the GPIO input, sets the pull-up to power, and continuously monitors the voltage on the UART_RX wire. There are two outcomes here.

a) The master has 0.0 V on the UART_RX wire. This means that there is at least one slave device on the RS485 bus whose address matches the Mx mask.

b) The master has 3.3V left on the UART_RX wire. This means that there is not a single device on the RS485 bus whose address matches the Mx mask. This means that we do not work with this Mx mask further and simply discard it to the side as a pre-wrong path. Moreover, the master waits not indefinitely, but for a strictly defined timeout time, which is common for all devices, for example 20ms.

4–In case 3.a), the mask is extended 1 bit to the left. There are also two options here. Either we assign a prefix of 0 or 1 to the mask of the detected device. We must follow both paths: 1 and 2.

No.	Mask	Explanation	Example
1	xx…x0[PREV_ACK_MASK]	increased by 0	x…x00
2	xx…x1[PREV_ACK_MASK]	increased by 1	x…x10

Here recursion or elements of dynamic programming can be traced. Each step spawns 2 steps: prefix 0 and prefix 1.

Then steps 2-3-4 can be repeated again and again until the mask reaches 32 bits. As soon as this happens, it will mean that one device has been found on the bus. But how to find the rest of the N-1 device?

5–As soon as the mask matches 32 bits, then the master device sends a command to mute the device at a certain address. The master sends a mute packet.

Steps 2-3-4-5 are essentially one iteration. On the next iteration, the wizard will detect another device. And so on until all the masks stop emitting an acknowledgment signal. After that, the RS485 bus will be fully scanned.

By the way, the mask with a length of zero (xxxx_xxxx_xxxx_xxxx_xxxx_xxxx_xxxx_xxxx) is answered by setting the confirmation signal All non-muted nodes of the RS485 network. Therefore, this mask installation packet can serve as a criterion for ending a network scan.

In fairness, we can add that we need to do the same for all possible RS485 bit rates: 9600, 115200, and so on. However, as a rule, the RS485 network is assembled from devices that already have a default bit rate.

Scan time at one bit rate will take

Option	Time	Explanation
best case	32Ndt	confirmation at first mask increase
worst case	32N2*dt	confirmation at second mask increase

where dt is the address mask response time

The common bus scanning algorithm can be represented as this packet exchange diagram

Advantages of this method

1++ Simplicity.

2++ efficiency

3++Speed of work in comparison with enumeration.

4++ no need for additional wires. All you need is one twisted pair of RS485 interface.

Minuses

1–Master device must be microcontroller with full GPIO and UART driver. It will not work just to take the first Chinese USB-RS485 adapter that comes across, connect it to a PC and write a Windows console application that will scan the RS485 bus. It is necessary that there is not only the ability to read / write bytes to RS485, but also to switch the functions of the pins from GPIO to UART and vice versa. Moreover, it is necessary to switch the functions of the pins quickly in order to have time to receive signals from Slave nodes.

2–We need software support for this simple RS485 scanning protocol on both the master and slave sides.

Conclusion

This simple shared bus address scanning algorithm is not just for RS485. It can be implemented for any other interface with a common bus topology. It can be 1Wire, LIN, or even completely wireless interfaces such as LoRa or UWB.

Dictionary