Sniffing the metrix mtx3283 DMM modbus protocol

[RoGeorge]

There is SX-DMM, a free software to control mtx3283, but it is for Windows only.  I would like to control the instrument from Linux, so I could get advantage of various Linux tools.

I couldn't find any Linux tool for the MTX 3283 DMM, so I start reverse engineering the protocol.  It is a MODBUS over serial RS232, a very well known protocol met usually in industrial devices and SCADA, with available documentation.
http://www.modbus.org/docs/Modbus_over_serial_line_V1.pdf

However, while the MODBUS protocol is easy and well standardized, the registers addresses and the registers meaning is not specified by modbus.  Each device defines its own registers upon wish.  Modbus sees them like some sort of memory mapped values, can read or write those registers, but has no knowledge about which register means what for a particular device.

I've installed the official SX-DMM software in a Win7 virtual machine, and sniffed the serial communication.  So far I found that:
- when establishing the communication for the first time, the old v2.2 software repeats the telegram 9 times if there is no response.  Telegrams are at 1 second apart, 3 times at 9600 baud, 3 times at 19200 and 3 more times at 38400 baud (in this order).  If no response, then it stops with error message no -120, "Channel 1 : Invalid message or Time Out".
- MTX 3283 uses 38400 baud, 8, n, 1
- protocol is modbus ASCII
- first modbus request is Read Holding Registers (0x03) from address 2, length 1 register
- the instrument replies with a telegram containing the number "3283", which obviously here is the instrument model

Code: [Select]

Protocol
========
- modbus ASCII
- 38400, 8, n, 1
- first command when communication initiated from sx-dmm 2.2 is
3a 01 03 00 02 00 01 f9 0d 0a
which is sent as ASCII
: 0 1 0 3 0 0 0 2 0 0 0 1 F 9 CR LF

which means
:         ---> header
0 1       ---> slave address (0x01)
0 3       ---> function (0x03 is for Read Holding Registers)
0 0 0 2   ---> start address (0x00 0x02)
0 0 0 1   ---> number of coils/registers (0x00 0x01)
F 9       ---> checksum (0xF9)
CR LF     ---> trailer

- the response from the instrument is '3283' (0x0cd3 == 3283, the instrument model).
- the response telegram in raw modbus is
3a 01 03 02 0c d3 1b 0d 0a
received as ASCII

- note that there is something with the checksum reported by QModBus, CRC is displayed in red as "0020 (0065)"


Does anybody have the modbus registers map for the Chauvin-Arnoux Metrix MTX 3283, 3282 or 3281?

[2N3055]

You can use SCPI too..

[RoGeorge]

WOW, THANK YOU!!!   

Now I'm very confused.  After a quick browse of the PDF you attached, those appears to be SCPI commands.

Can MTX 3283 talk SCPI over serial RS232?   

I always thought it cannot.  Will look closer and test it this evening, thank you again for the programming manual PDF.

[RoGeorge]

My MTX3283 is from 2007 (last calibration date), I couldn't make it to respond to SCPI.

At this point I think SCPI for this DMM is possible only with a special LabVIEW driver, and the driver is the one who translates SCPI commands into MODBUS commands sent over the RS232 to the optical port of the MTX3283.  I could find LabVIEW drivers for many other DMMs on the Metrix website, but not for MTX 3283.  Also sniffed various commands sent by their Metrix software, SX-DMM, and it talks to the instrument only MODBUS, never SCPI.

Anyways, since the DMM does not talk SCPI natively, I certainly don't want yet another software component (LabVIEW) to depend of.

After almost half a day of online searching, I couldn't find any other useful documentation or projects to control the instrument.  Trying various versions of SX-DMM (Windows only software from Metrix, to control the DMM) I come up of a long forgotten copy of the original CD software of the instrument.

On the original software CD there is a PDF with the MODBUS map of my MTX 3283.   

All the time spent on RS232 sniffing, reverse engineering and online searching was for nothing, while all the info I was looking for was sitting right under my nose, in a nicely written PDF saved on my own PC.  Classic case of RTFM!

Since I couldn't find online any MODBUS programming guide at all, I am attaching and please pardon my French. 

[RoGeorge]

I was asked by PM to share the old SX-DMM V2.2 I have on the original instrument's CDs, especially because that version can run on Windows XP, and nowadays it is not easy to find online.

Here are the 2 CDs that came with my instrument.  First one is a Metrix branded CD, it has an "SX-DMM v2.2 Demo" on it, but apparently it is working the same as a non-demo version.

The second disk is a diy burnt CD that has an SX-DMM v2.2 on it (without "demo" in its name).

Apart from that, yesterday I fulled around with some Python scripts, and was able to control the instrument from Python.
 
That means no matter the OS, Windows, Linux, MAC or anything else with a serial port and suppporting Python will be able to do whatever you like with an MTX 328x DMM.

Need to polish it a little, will post the results soon, but if you are eager to tinker with it by yourself, Python with "minimalmodbus" module worked just fine for me.   

To download the CDs of my Metrix MTX3283 from 2007, with SX-DMM v2.2 Demo and non demo included, here's a personal storage place (SX-DMM v2.2 tested and working on either Windows XP or Windows 7, either virtual machines or bare metal install machines):
http://s.go.ro/sy01xg1r | password: 424189

[RoGeorge]

The Linux executable 'mtx3283_read' reads the DMM and prints in the terminal the measured value displayed on the mtx3283 screen.  It expect the DMM to be connected with it's optical cable on the first serial port /dev/ttyS0 at 38400 baud.

This is the python source that was packed in a single executable file and attached here as file 'mtx3283_read'.

Code: [Select]

import minimalmodbus as mm
instr = mm.Instrument('/dev/ttyS0', 1)  # port name, slave address (in decimal)

instr.serial.baudrate = 38400
instr.serial.timeout = 1.0
instr.mode = mm.MODE_ASCII

MTX_read_F1 = instr.read_float(40960)
print(MTX_read_F1)

To create a modified executable starting from its python sources you'll need Python 3, minimalmodbus and PyInstaller.  If pyinstaller fails with error bytes instead of int, use either a Python less than v3.8 or install the fixed version of pyinstaller as told in https://github.com/pyinstaller/pyinstaller/issues/4265#issuecomment-546221741

I've used this script to make automated reading for voltage and current in order to calibrate a Rigol DP832 power supply.  Can be used whenever one wants to read the main displayed value from the mtx3283 DMM from a Linux terminal.  Can be called from scripts or run manually from a terminal.  It waas tested on Kubuntu 20.04 LTS.


All the above is relevant only to modify or create another executable.  To use the DMM reader, just download the 'mtx3283_read' file, make it executable, open a Linux terminal to the folder where the downloaded file was saved, and type

Code: [Select]

./mtx3283_read
-9.000000136438757e-05