chore: 更新固件版本日期至0528，新增Modbus从站仿真工具及测试说明

feat: DI报警改为Modbus RTU报警上报，心跳包IO位替换为RTU报警状态，添加详细中文注释
remove invalid Windows reserved filename 'nul'
2026-05-28 13:35:25 +08:00 · 2026-05-28 13:03:28 +08:00 · 2026-05-27 18:35:36 +08:00 · 2026-05-27 18:32:21 +08:00 · 2026-05-27 17:15:57 +08:00 · 2026-05-10 17:13:02 +08:00
37 changed files with 1541 additions and 173 deletions
--- a/Core/Inc/main.h
+++ b/Core/Inc/main.h
@@ -48,6 +48,36 @@ extern "C" {
 /* Exported macro ------------------------------------------------------------*/
 /* USER CODE BEGIN EM */

+// 基准年份
+#define XTELL_BASE_YEAR 2026
+/**
+ * 宏定义：3-4-5-4 固件版本编码
+ * y: Year (2026-2033)
+ * m: Month (1-12)
+ * d: Day (1-31)
+ * b: Build (0-15)
+ */
+#define MAKE_XTELL_CODE(y, m, d, b) ( \
+    ((( (y) - XTELL_BASE_YEAR ) & 0x07) << 13) | \
+    (((m) & 0x0F) << 9)  | \
+    (((d) & 0x1F) << 4)  | \
+    (((b) & 0x0F) << 0)    \
+)
+
+// 举例：2026年3月19日，第10次编译 (b=9)
+// 计算过程: (0 << 13) | (3 << 9) | (19 << 4) | 9 = 0x0600 | 0x0130 | 0x0009
+#define XTELL_FIRMWARE_CODE  MAKE_XTELL_CODE(2026, 5, 28, 1)
+//                                           ----  -  --  -
+//                                             |   |   |  |
+//                                             |   |   |  编译次数
+//                                             |   |   日
+//                                             |   月
+//                                             年
+
+#ifndef HEARTBEAT_PACKET
+#define HEARTBEAT_PACKET 1 /* 启用心跳包上报 */
+#endif
+
 #ifndef USE_W5500
 #define USE_W5500 1 /* 默认启用W5500以太网模块 */
 #endif
@@ -67,13 +97,23 @@ extern "C" {
 #define PROTO_TYPE_IO       0x10
 #define PROTO_TYPE_NET      0x55
 #define PROTO_TYPE_485      0x48
+#define PROTO_TYPE_MODBUS_RTU 0x4D
 #define PROTO_TYPE_HB       0xAA

 /* =========================================================
   🚀 核心身份标识：烧录不同设备时，请务必修改这个数字！
   比如：设备A烧录时改为 0x01，设备B烧录时改为 0x02
   ========================================================= */
-#define MY_DEVICE_ID  0x02
+#define MY_DEVICE_ID       105
+
+/* =========================================================
+   🚀 开发调试开关
+   TEST_A701: 
+   - 1: 测试环境 (A701室/本地测试)，使用 192.168.6.x 网段
+   - 0: 生产环境 (实船/现场部署)，使用 192.168.0.x 网段
+   ========================================================= */
+#define TEST_A701  0
+
 /* USER CODE END EM */

 /* Exported functions prototypes ---------------------------------------------*/
--- a/Core/Inc/modbus_rtu_master.h
+++ b/Core/Inc/modbus_rtu_master.h
@@ -0,0 +1,143 @@
+/**
+  ******************************************************************************
+  * @file    modbus_rtu_master.h
+  * @brief   Modbus RTU Master 模块头文件
+  * @note    本模块通过 RS485 (UART3) 以 Modbus RTU 协议轮询 Noris AMS 从站设备，
+  *          读取寄存器 41161 (偏移地址 1160) 中的报警状态，
+  *          提取 Bit4-7 (火灾/水密门/舱底水/气体检测) 映射为紧凑报警字节。
+  *
+  *          报警状态供 main.c 中的两种上报机制使用：
+  *          1. 变化通知 (Type 0x10): 报警状态变化时，通过 PROTO_TYPE_IO 上报，
+  *             格式与原 DI 变化通知完全一致，上位机代码无需修改。
+  *          2. 心跳包 (Type 0xAA): 每 30 秒定时上报当前报警状态。
+  *
+  * @version 1.1
+  ******************************************************************************
+  */
+
+#ifndef __MODBUS_RTU_MASTER_H
+#define __MODBUS_RTU_MASTER_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include "stm32f1xx_hal.h"
+
+/* ================================================================
+ *  Modbus RTU 通信参数配置
+ *  修改以下宏定义可适配不同的从站设备和通信需求
+ * ================================================================ */
+
+/** 从站设备地址 (Noris AMS 默认地址 = 1) */
+#define MODBUS_RTU_SLAVE_ADDR          1
+
+/** 目标寄存器偏移地址 (1160 对应 Noris 协议中的寄存器 41161) */
+#define MODBUS_RTU_TARGET_REG          1160
+
+/** 单次读取的寄存器数量 (当前只读取 1 个报警寄存器) */
+#define MODBUS_RTU_REG_QTY             1
+
+/** 轮询间隔 (毫秒)，每隔此时间发送一次 Read Holding Registers 请求 */
+#define MODBUS_RTU_POLL_INTERVAL       1000
+
+/** 响应超时 (毫秒)，发送请求后等待从站响应的最长时间，超时则丢弃本次轮询 */
+#define MODBUS_RTU_RESP_TIMEOUT        500
+
+/** 帧内字符间隔超时 (毫秒)，接收过程中两个相邻字节的最大间隔时间，
+ *  超过此时间认为一帧数据接收完成 */
+#define MODBUS_RTU_INTER_CHAR_TIMEOUT  10
+
+/** 发送回波屏蔽时间 (毫秒)，UART3 发送后屏蔽自身回波的时间窗口，
+ *  防止将自身发送的数据误判为从站响应 */
+#define MODBUS_RTU_TX_ECHO_MARGIN     10
+
+/* ================================================================
+ *  Noris AMS 报警位提取宏
+ *  从 16 位寄存器值中提取各个报警标志位
+ *
+ *  寄存器 41161 的位布局:
+ *    Bit4: 火灾综合报警 (Fire)
+ *    Bit5: 水密门综合报警 (Door)
+ *    Bit6: 舱底水综合报警 (Bilge)
+ *    Bit7: 气体检测综合报警 (Gas)
+ *
+ *  提取后映射到紧凑报警字节:
+ *    Bit0 ← Bit4 (火灾)
+ *    Bit1 ← Bit5 (水密门)
+ *    Bit2 ← Bit6 (舱底水)
+ *    Bit3 ← Bit7 (气体检测)
+ * ================================================================ */
+
+/** 提取火灾综合报警 (寄存器 Bit4) */
+#define NORIS_FIRE_ALARM(reg)    (((reg) >> 4) & 0x01)
+
+/** 提取水密门综合报警 (寄存器 Bit5) */
+#define NORIS_DOOR_ALARM(reg)    (((reg) >> 5) & 0x01)
+
+/** 提取舱底水综合报警 (寄存器 Bit6) */
+#define NORIS_BILGE_ALARM(reg)   (((reg) >> 6) & 0x01)
+
+/** 提取气体检测综合报警 (寄存器 Bit7) */
+#define NORIS_GAS_ALARM(reg)     (((reg) >> 7) & 0x01)
+
+/* ================================================================
+ *  接收缓冲区配置
+ * ================================================================ */
+
+/** Modbus RTU 接收缓冲区最大长度 (字节)，
+ *  正常响应帧为 7 字节，64 字节足够容纳各种响应 */
+#define MODBUS_RTU_MAX_RX_BUF   64
+
+/* ================================================================
+ *  公共函数接口
+ * ================================================================ */
+
+/**
+  * @brief  Modbus RTU Master 模块初始化
+  * @note   在系统启动时调用，将状态机重置为 IDLE 状态，
+  *         清空接收缓冲区和报警状态变量
+  * @retval 无
+  */
+void ModbusRTU_Master_Init(void);
+
+/**
+  * @brief  Modbus RTU Master 主任务函数
+  * @note   在主循环中周期性调用，实现状态机驱动的轮询逻辑:
+  *         IDLE → WAIT_POLL → WAIT_RESPONSE → PROCESS → IDLE
+  *
+  *         状态说明:
+  *         - IDLE: 等待轮询间隔到达 (1000ms)
+  *         - WAIT_POLL: 发送 Modbus RTU 请求帧
+  *         - WAIT_RESPONSE: 等待从站响应或超时
+  *         - PROCESS: 解析响应帧，提取寄存器值和报警位
+  *
+  * @retval 无
+  */
+void ModbusRTU_Master_Task(void);
+
+/**
+  * @brief  向 Modbus RTU 接收缓冲区送入一个字节
+  * @note   在 UART3 接收中断回调中调用 (HAL_UART_RxCpltCallback)，
+  *         仅在 WAIT_RESPONSE 状态且不在回波屏蔽期内才接收数据
+  * @param  byte: 从 UART3 接收到的原始字节
+  * @retval 无
+  */
+void ModbusRTU_FeedRxByte(uint8_t byte);
+
+/**
+  * @brief  获取当前 Modbus RTU 报警状态
+  * @note   返回紧凑报警字节，位定义如下:
+  *         Bit0: 火灾报警
+  *         Bit1: 水密门报警
+  *         Bit2: 舱底水报警
+  *         Bit3: 气体检测报警
+  * @retval 报警状态字节 (uint8_t)
+  */
+uint8_t ModbusRTU_GetAlarmState(void);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
--- a/Core/Inc/modbus_tcp_client.h
+++ b/Core/Inc/modbus_tcp_client.h
@@ -0,0 +1,55 @@
+/**
+  ******************************************************************************
+  * @file    modbus_tcp_client.h
+  * @brief   Modbus TCP 客户端模块头文件 (基于 W5500)
+  ******************************************************************************
+  */
+
+#ifndef __MODBUS_TCP_CLIENT_H
+#define __MODBUS_TCP_CLIENT_H
+
+#include <stdint.h>
+#include <stdbool.h>
+#include "main.h"
+
+/* Modbus TCP 配置 */
+#if TEST_A701
+#define MODBUS_SERVER_IP     {192, 168, 6, 156}  /* A701 测试服务器 */
+#else
+#define MODBUS_SERVER_IP     {192, 168, 0, 1}  /* 现场生产服务器 */
+#endif
+
+#define MODBUS_SERVER_PORT   502
+#define MODBUS_UNIT_ID       1
+#define MODBUS_POLL_INTERVAL 2000  /* 轮询间隔 (ms) */
+
+/* 寄存器定义 */
+#define TARGET_REG_ADDR      30    /* 逻辑 40031 */
+
+/* 客户端状态枚举 */
+typedef enum {
+    MODBUS_STATE_IDLE,
+    MODBUS_STATE_CONNECTING,
+    MODBUS_STATE_SEND_QUERY,
+    MODBUS_STATE_WAIT_RESPONSE,
+    MODBUS_STATE_ERROR_RETRY
+} modbus_client_state_t;
+
+/**
+ * @brief  初始化 Modbus TCP 客户端
+ * @param  sn: W5500 Socket 编号
+ */
+void ModbusTCP_Client_Init(uint8_t sn);
+
+/**
+ * @brief  Modbus TCP 客户端任务处理 (主循环调用)
+ */
+void ModbusTCP_Client_Task(void);
+
+/**
+ * @brief  获取最新成功读取的 Modbus 寄存器值
+ * @retval 16位寄存器值 (未读到时默认返回 0xFFFF)
+ */
+uint16_t ModbusTCP_Get_LastRegVal(void);
+
+#endif
--- a/Core/Src/cmd_router.c
+++ b/Core/Src/cmd_router.c
@@ -28,9 +28,6 @@
 #include "uart2_print.h"
 #include "debug_log.h"
 #include "data_source.h"
-#include "uart3_protocol_discriminator.h"
-#include "uart3_protocol_discriminator.h"
-#include "uart3_passthrough.h"
 #include "uart3_smart_router_config.h"
 #include <string.h>

--- a/Core/Src/debug_log.c
+++ b/Core/Src/debug_log.c
@@ -144,6 +144,6 @@ void DebugLog_Output(log_level_t level, const char *module, const char *fmt, ...
    
    if (len > 0) {
        UART2_Print_Send((const uint8_t *)buffer, len);
-        MultiUART_Send(PORT_RS485, (const uint8_t *)buffer, len); /* 增加：同时将日志发给 RS485 */
+        // MultiUART_Send(PORT_RS485, (const uint8_t *)buffer, len); /* 增加：同时将日志发给 RS485 */
    }
 }
--- a/Core/Src/main.c
+++ b/Core/Src/main.c
@@ -40,6 +40,9 @@
 #include "cmd_router.h"
 #include "debug_log.h"

+/* Modbus RTU Master 模块头文件 */
+#include "modbus_rtu_master.h"
+
 /* W5500 Ethernet模块头文件 */
 #if USE_W5500
 #include "user_main.h"
@@ -47,6 +50,7 @@
 #include "wiz_interface.h"
 #include "wizchip_conf.h"
 #include "loopback.h"
+#include "modbus_tcp_client.h"
 #endif
 extern void wiz_timer_handler(void);
 #if (RF433_MODE == RF433_MODE_TX) || (RF433_MODE == RF433_MODE_BOTH)
@@ -85,16 +89,10 @@ static uint8_t u1_rx_buffer[256];
 static volatile uint16_t u1_rx_len = 0;
 static volatile uint32_t u1_last_rx_time = 0;

-/* === 485 设备的接收缓存 (UART3) === */
-static uint8_t u3_rx_buffer[512];
-static volatile uint16_t u3_rx_len = 0;
-static volatile uint32_t u3_last_rx_time = 0;
-static volatile uint32_t u3_ignore_until = 0;
-
 /* === 协议处理全局变量 === */
 static uint16_t g_hb_seq = 0;        /* 心跳序列号 */
 static uint32_t g_last_hb_tick = 0;  /* 上次心跳时间 */
-static uint8_t g_last_io_state = 0xFF; /* 上次记录的 IO 状态，用于变化检测 */
+static uint8_t g_last_alarm_state = 0xFF; /* 上次 Modbus RTU 报警状态，用于变化检测 */

 /* === W5500 外部变量声明 === */
 #if USE_W5500
@@ -171,7 +169,9 @@ uint8_t IO_Get_Current_State(void)
 /* W5500 variables */
 #if USE_W5500
 #define SOCKET_ID 0
+#ifndef ETHERNET_BUF_MAX_SIZE
 #define ETHERNET_BUF_MAX_SIZE 2048
+#endif
 static uint8_t ethernet_buf[ETHERNET_BUF_MAX_SIZE] = {0};
 static uint16_t local_port = 8000;
 #endif
@@ -247,6 +247,7 @@ int main(void)
  /* 启动UART3接收中断 - RS485接口 */
  #if USE_RS485
  HAL_UART_Receive_IT(&huart3, &uart3_rx_byte, 1);
+  ModbusRTU_Master_Init();
  #endif
  
  /* 初始化RF433模块 - 使用默认配置 */
@@ -263,8 +264,16 @@ int main(void)

  printf("[DEBUG] 4. 进入 network_init()\r\n");
  network_init(ethernet_buf, &default_net_info);
-  printf("[DEBUG] 5. network_init() 成功返回!\r\n");
-  printf("wizchip UDP example started\r\n");
+  printf("[DEBUG] 5. network_init() 成功返回!\n");
+  
+  printf("--- Socket Status Diagnostic ---\n");
+  for (int i=0; i<8; i++) {
+      printf("Socket %d SR: 0x%02X\n", i, getSn_SR(i));
+  }
+  printf("--------------------------------\n");
+  
+  printf("Modbus TCP Client starting\n");
+  ModbusTCP_Client_Init(1); // 暂时使用 Socket 1 进行测试，避开可能被污染的 Socket 0
  #endif
  /* ======================================= */

@@ -307,9 +316,9 @@ int main(void)
    rf433_rx_app_task();
 #endif

-    /* W5500 UDP回环任务 */
+    /* W5500 UDP回环任务（为了测试 PING 功能，放到了单独的 Socket 2） */
    #if USE_W5500
-    loopback_udps(SOCKET_ID, ethernet_buf, local_port);
+    loopback_udps(2, ethernet_buf, local_port);
    #endif


@@ -322,9 +331,8 @@ int main(void)
      UART2_Print_Task();
      MultiUART_Task();

-      /* === 2. 无线接收透传 (433 -> 485/Debug) === */
+      /* === 2. 无线接收透传 (433 -> Debug) === */
      #if (RF433_MODE == RF433_MODE_RX) || (RF433_MODE == RF433_MODE_BOTH)
-      // 如果 433 收到无线数据，直接透传输出，不进行解码
      if (u1_rx_len > 0 && (HAL_GetTick() - u1_last_rx_time > 20)) 
      {
          __disable_irq();
@@ -332,7 +340,6 @@ int main(void)
          u1_rx_len = 0;
          __enable_irq();

-          MultiUART_Send(PORT_RS485, (uint8_t*)u1_rx_buffer, len);
          MultiUART_Send(PORT_DEBUG, (uint8_t*)u1_rx_buffer, len);
      }
      #endif
@@ -346,52 +353,57 @@ int main(void)

      /* === 4. 实时数据采集与上报 (仅在非发射状态运行) === */

-      // (A) 485 来源数据处理 (Type 0x48)
+      // (A) Modbus RTU 轮询任务
+      #if USE_RS485
+      ModbusRTU_Master_Task();
+      #endif
+
+      // (B) Modbus RTU 报警状态变化上报 (Type 0x10，与原 DI 格式兼容)
      #if USE_RS485
-      if (u3_rx_len > 0 && (HAL_GetTick() - u3_last_rx_time > 20)) 
      {
-          static uint8_t temp_buf3[512];
-          __disable_irq(); 
-          uint16_t len = u3_rx_len;
-          memcpy(temp_buf3, (uint8_t*)u3_rx_buffer, len);
-          u3_rx_len = 0; 
-          __enable_irq();
-
-          RF433_SendPacket(PROTO_TYPE_485, temp_buf3, len);
-      }
-      #endif
-
-      // (B) I/O 状态监控与变化上报 (Type 0x10)
-      #if USE_IO_MONITOR
-      IO_Monitor_Task(); // 执行去抖扫描
-      uint8_t current_io = IO_Monitor_GetAllStates(); 
-      if (current_io != g_last_io_state) {
-          if (g_last_io_state == 0xFF) {
-              g_last_io_state = current_io;
+          uint8_t alarm_state = ModbusRTU_GetAlarmState();
+          if (alarm_state != g_last_alarm_state) {
+              if (g_last_alarm_state != 0xFF) {
+                  g_last_alarm_state = alarm_state;
+                  RF433_SendPacket(PROTO_TYPE_IO, &alarm_state, 1);
              } else {
-              g_last_io_state = current_io;
-              RF433_SendPacket(PROTO_TYPE_IO, &current_io, 1);
+                  g_last_alarm_state = alarm_state;
+              }
          }
      }
      #endif

+
+      #if  HEARTBEAT_PACKET
      // (C) 30秒系统心跳包 (Type 0xAA)
-      #if USE_IO_MONITOR
      if (HAL_GetTick() - g_last_hb_tick >= 30000) {
          g_last_hb_tick = HAL_GetTick();
-          uint8_t hb_payload[3];
-          hb_payload[0] = IO_Monitor_GetAllStates();
-          hb_payload[1] = (uint8_t)(g_hb_seq >> 8);
-          hb_payload[2] = (uint8_t)(g_hb_seq & 0xFF);
+          uint8_t hb_payload[7];
+
+          hb_payload[0] = (uint8_t)(g_hb_seq >> 8);
+          hb_payload[1] = (uint8_t)(g_hb_seq & 0xFF);
+
+          hb_payload[2] = (uint8_t)(XTELL_FIRMWARE_CODE >> 8);
+          hb_payload[3] = (uint8_t)(XTELL_FIRMWARE_CODE & 0xFF);
+
+          hb_payload[4] = ModbusRTU_GetAlarmState();
+
+          uint16_t modbus_val = 0xFFFF;
+          #if USE_W5500
+          modbus_val = ModbusTCP_Get_LastRegVal();
+          #endif
+          hb_payload[5] = (uint8_t)(modbus_val >> 8);
+          hb_payload[6] = (uint8_t)(modbus_val & 0xFF);
+
          g_hb_seq++;

-          RF433_SendPacket(PROTO_TYPE_HB, hb_payload, 3);
+          RF433_SendPacket(PROTO_TYPE_HB, hb_payload, sizeof(hb_payload));
      }
      #endif

-      // (D) W5500 以太网轮询处理 (Type 0x55)
+
      #if USE_W5500
-      loopback_udps(SOCKET_ID, ethernet_buf, local_port);
+      ModbusTCP_Client_Task();
      #endif
      
      /* USER CODE END WHILE */
@@ -460,11 +472,7 @@ void HAL_UART_RxCpltCallback(UART_HandleTypeDef *huart)
        HAL_UART_Receive_IT(&huart1, &rf433_uart_rx_tmp, 1);
    }
    else if (huart->Instance == USART3) {
-        /* 🚀 核心生效区：只有当单片机没有在发送数据时（度过屏蔽期），才允许接收 */
-        if (HAL_GetTick() >= u3_ignore_until) {
-            if (u3_rx_len < sizeof(u3_rx_buffer)) u3_rx_buffer[u3_rx_len++] = uart3_rx_byte;
-            u3_last_rx_time = HAL_GetTick();
-        }
+        ModbusRTU_FeedRxByte(uart3_rx_byte);
        HAL_UART_Receive_IT(&huart3, &uart3_rx_byte, 1);
    }
    else if (huart->Instance == USART2) {
@@ -503,16 +511,8 @@ void HAL_UART_TxCpltCallback(UART_HandleTypeDef *huart)
    }
    else if (huart->Instance == USART2)
    {
-        /* 调用UART2打印模块的发送完成回调 */
        UART2_Print_TxCpltCallback();
    }
-    else if (huart->Instance == USART3)
-    {
-       
-        /* 调用多UART路由器的UART3发送完成回调 */
-        MultiUART_TxCpltCallback(PORT_RS485);
-    
-    }
 }

 /* USER CODE END 4 */
--- a/Core/Src/modbus_rtu_master.c
+++ b/Core/Src/modbus_rtu_master.c
@@ -0,0 +1,380 @@
+/**
+  ******************************************************************************
+  * @file    modbus_rtu_master.c
+  * @brief   Modbus RTU Master 模块实现
+  * @note    本模块通过 RS485 (UART3) 以 Modbus RTU 协议轮询 Noris AMS 从站，
+  *          读取寄存器 41161 中的报警状态位，并提取为紧凑报警字节。
+  *
+  *          工作原理:
+  *          1. 每 1000ms 发送一次 Read Holding Registers (FC=0x03) 请求
+  *          2. 等待从站响应，支持帧内字符超时检测和响应总超时
+  *          3. 解析响应帧并进行 CRC16 校验
+  *          4. 从寄存器值中提取 Bit4-7 的报警位，映射为紧凑报警字节
+  *          5. 报警状态由 main.c 负责上报 (变化通知 + 心跳包)
+  *
+  *          状态机流转:
+  *          IDLE → WAIT_POLL → WAIT_RESPONSE → PROCESS → IDLE
+  *
+  * @version 1.1
+  ******************************************************************************
+  */
+
+#include "modbus_rtu_master.h"
+#include "usart.h"
+#include "main.h"
+#include <string.h>
+
+/* ================================================================
+ *  CRC16-Modbus 查找表 (256 项)
+ *  多项式: 0xA001 (反转形式)，初始值: 0xFFFF
+ *  用于 Modbus RTU 帧的 CRC 校验计算，采用查表法加速运算
+ * ================================================================ */
+static const uint16_t crc16_table[256] = {
+    0x0000, 0xC0C1, 0xC181, 0x0140, 0xC301, 0x03C0, 0x0280, 0xC241,
+    0xC601, 0x06C0, 0x0780, 0xC741, 0x0500, 0xC5C1, 0xC481, 0x0440,
+    0xCC01, 0x0CC0, 0x0D80, 0xCD41, 0x0F00, 0xCFC1, 0xCE81, 0x0E40,
+    0x0A00, 0xCAC1, 0xCB81, 0x0B40, 0xC901, 0x09C0, 0x0880, 0xC841,
+    0xD801, 0x18C0, 0x1980, 0xD941, 0x1B00, 0xDBC1, 0xDA81, 0x1A40,
+    0x1E00, 0xDEC1, 0xDF81, 0x1F40, 0xDD01, 0x1DC0, 0x1C80, 0xDC41,
+    0x1400, 0xD4C1, 0xD581, 0x1540, 0xD701, 0x17C0, 0x1680, 0xD641,
+    0xD201, 0x12C0, 0x1380, 0xD341, 0x1100, 0xD1C1, 0xD081, 0x1040,
+    0xF001, 0x30C0, 0x3180, 0xF141, 0x3300, 0xF3C1, 0xF281, 0x3240,
+    0x3600, 0xF6C1, 0xF781, 0x3740, 0xF501, 0x35C0, 0x3480, 0xF441,
+    0x3C00, 0xFCC1, 0xFD81, 0x3D40, 0xFF01, 0x3FC0, 0x3E80, 0xFE41,
+    0xFA01, 0x3AC0, 0x3B80, 0xFB41, 0x3900, 0xF9C1, 0xF881, 0x3840,
+    0x2800, 0xE8C1, 0xE981, 0x2940, 0xEB01, 0x2BC0, 0x2A80, 0xEA41,
+    0xEE01, 0x2EC0, 0x2F80, 0xEF41, 0x2D00, 0xEDC1, 0xEC81, 0x2C40,
+    0xE401, 0x24C0, 0x2580, 0xE541, 0x2700, 0xE7C1, 0xE681, 0x2640,
+    0x2200, 0xE2C1, 0xE381, 0x2340, 0xE101, 0x21C0, 0x2080, 0xE041,
+    0xA001, 0x60C0, 0x6180, 0xA141, 0x6300, 0xA3C1, 0xA281, 0x6240,
+    0x6600, 0xA6C1, 0xA781, 0x6740, 0xA501, 0x65C0, 0x6480, 0xA441,
+    0x6C00, 0xACC1, 0xAD81, 0x6D40, 0xAF01, 0x6FC0, 0x6E80, 0xAE41,
+    0xAA01, 0x6AC0, 0x6B80, 0xAB41, 0x6900, 0xA9C1, 0xA881, 0x6840,
+    0x7800, 0xB8C1, 0xB981, 0x7940, 0xBB01, 0x7BC0, 0x7A80, 0xBA41,
+    0xBE01, 0x7EC0, 0x7F80, 0xBF41, 0x7D00, 0xBDC1, 0xBC81, 0x7C40,
+    0xB401, 0x74C0, 0x7580, 0xB541, 0x7700, 0xB7C1, 0xB681, 0x7640,
+    0x7200, 0xB2C1, 0xB381, 0x7340, 0xB101, 0x71C0, 0x7080, 0xB041,
+    0x5000, 0x90C1, 0x9181, 0x5140, 0x9301, 0x53C0, 0x5280, 0x9241,
+    0x9601, 0x56C0, 0x5780, 0x9741, 0x5500, 0x95C1, 0x9481, 0x5440,
+    0x9C01, 0x5CC0, 0x5D80, 0x9D41, 0x5F00, 0x9FC1, 0x9E81, 0x5E40,
+    0x5A00, 0x9AC1, 0x9B81, 0x5B40, 0x9901, 0x59C0, 0x5880, 0x9841,
+    0x8801, 0x48C0, 0x4980, 0x8941, 0x4B00, 0x8BC1, 0x8A81, 0x4A40,
+    0x4E00, 0x8EC1, 0x8F81, 0x4F40, 0x8D01, 0x4DC0, 0x4C80, 0x8C41,
+    0x4400, 0x84C1, 0x8581, 0x4540, 0x8701, 0x47C0, 0x4680, 0x8641,
+    0x8201, 0x42C0, 0x4380, 0x8341, 0x4100, 0x81C1, 0x8081, 0x4040
+};
+
+/* ================================================================
+ *  状态机枚举定义
+ *  Modbus RTU Master 使用四状态状态机驱动轮询过程
+ * ================================================================ */
+
+/**
+  * @brief  Modbus RTU 轮询状态机状态枚举
+  * - MB_STATE_IDLE:          空闲状态，等待轮询间隔到达
+  * - MB_STATE_WAIT_POLL:     准备发送，立即发送请求帧
+  * - MB_STATE_WAIT_RESPONSE: 已发送请求，等待从站响应
+  * - MB_STATE_PROCESS:       帧接收完成，解析响应数据
+  */
+typedef enum {
+    MB_STATE_IDLE,
+    MB_STATE_WAIT_POLL,
+    MB_STATE_WAIT_RESPONSE,
+    MB_STATE_PROCESS
+} mb_state_t;
+
+/* ================================================================
+ *  模块内部静态变量
+ * ================================================================ */
+
+/** 当前状态机状态 */
+static mb_state_t mb_state = MB_STATE_IDLE;
+
+/** 当前状态的进入时刻 (用于超时判断) */
+static uint32_t mb_state_tick = 0;
+
+/** 上一次轮询的时刻 (用于计算轮询间隔) */
+static uint32_t mb_last_poll_tick = 0;
+
+/** 回波屏蔽截止时间 (发送后忽略自身回波的时间点) */
+static uint32_t ignore_echo_until = 0;
+
+/** 接收缓冲区: 存储从站响应的原始字节 */
+static uint8_t mb_rx_buf[MODBUS_RTU_MAX_RX_BUF];
+
+/** 接收缓冲区当前写入索引 */
+static uint8_t mb_rx_idx = 0;
+
+/** 最后一次接收到字节的时刻 (用于帧间超时判断) */
+static uint32_t mb_rx_last_byte_tick = 0;
+
+/** 当前报警状态字节 (紧凑格式，Bit0-3 对应 4 种报警) */
+static uint8_t mb_alarm_state = 0;
+
+/** 上一次报警状态 (用于变化检测，初始值 0xFF 表示首次轮询) */
+static uint8_t mb_alarm_last = 0xFF;
+
+/** 最近一次成功读取的寄存器原始值 (16-bit，大端序解析) */
+static uint16_t mb_reg_val = 0;
+
+/* ================================================================
+ *  内部静态函数实现
+ * ================================================================ */
+
+/**
+  * @brief  计算 Modbus CRC16 校验值
+  * @note   采用查表法，多项式 0xA001，初始值 0xFFFF
+  *         CRC16-Modbus 算法: 低字节在前 (Little-Endian)
+  * @param  data: 待计算的数据缓冲区指针
+  * @param  len:  数据长度 (字节)
+  * @retval CRC16 校验值
+  */
+static uint16_t modbus_crc16(const uint8_t *data, uint16_t len)
+{
+    uint16_t crc = 0xFFFF;
+    for (uint16_t i = 0; i < len; i++) {
+        crc = (crc >> 8) ^ crc16_table[(crc ^ data[i]) & 0xFF];
+    }
+    return crc;
+}
+
+/**
+  * @brief  从 16 位寄存器值中提取报警位，映射为紧凑报警字节
+  * @note   映射关系:
+  *         寄存器 Bit4 → 报警字节 Bit0 (火灾)
+  *         寄存器 Bit5 → 报警字节 Bit1 (水密门)
+  *         寄存器 Bit6 → 报警字节 Bit2 (舱底水)
+  *         寄存器 Bit7 → 报警字节 Bit3 (气体检测)
+  * @param  reg: 16 位寄存器原始值
+  * @retval 紧凑报警字节 (Bit0-3 有效)
+  */
+static uint8_t extract_alarm_bits(uint16_t reg)
+{
+    uint8_t alarm = 0;
+    if (NORIS_FIRE_ALARM(reg))  alarm |= (1 << 0);
+    if (NORIS_DOOR_ALARM(reg))  alarm |= (1 << 1);
+    if (NORIS_BILGE_ALARM(reg)) alarm |= (1 << 2);
+    if (NORIS_GAS_ALARM(reg))   alarm |= (1 << 3);
+    return alarm;
+}
+
+/**
+  * @brief  构造并发送 Modbus RTU Read Holding Registers 请求帧
+  * @note   帧格式: [从站地址][FC=0x03][起始地址H][起始地址L][数量H][数量L][CRC_L][CRC_H]
+  *         发送完成后设置回波屏蔽窗口，并清空接收缓冲区
+  * @retval 无
+  */
+static void send_modbus_request(void)
+{
+    uint8_t tx[8];
+
+    /* 构造请求帧 PDU */
+    tx[0] = MODBUS_RTU_SLAVE_ADDR;                          /* 从站地址 */
+    tx[1] = 0x03;                                            /* 功能码: Read Holding Registers */
+    tx[2] = (uint8_t)(MODBUS_RTU_TARGET_REG >> 8);          /* 寄存器起始地址高字节 */
+    tx[3] = (uint8_t)(MODBUS_RTU_TARGET_REG & 0xFF);        /* 寄存器起始地址低字节 */
+    tx[4] = (uint8_t)(MODBUS_RTU_REG_QTY >> 8);             /* 读取数量高字节 */
+    tx[5] = (uint8_t)(MODBUS_RTU_REG_QTY & 0xFF);           /* 读取数量低字节 */
+
+    /* 计算并附加 CRC16 (低字节在前) */
+    uint16_t crc = modbus_crc16(tx, 6);
+    tx[6] = (uint8_t)(crc & 0xFF);                           /* CRC 低字节 */
+    tx[7] = (uint8_t)(crc >> 8);                              /* CRC 高字节 */
+
+    /* 设置回波屏蔽窗口: 发送后 MODBUS_RTU_TX_ECHO_MARGIN 毫秒内忽略接收数据 */
+    ignore_echo_until = HAL_GetTick() + MODBUS_RTU_TX_ECHO_MARGIN;
+
+    /* 清空接收缓冲区，准备接收新响应 */
+    mb_rx_idx = 0;
+
+    /* 通过 UART3 (RS485) 阻塞发送请求帧 */
+    HAL_UART_Transmit(&huart3, tx, 8, HAL_MAX_DELAY);
+}
+
+/**
+  * @brief  解析 Modbus RTU 响应帧
+  * @note   校验流程:
+  *         1. 最小帧长度检查 (≥5 字节: 地址 + FC + 字节数 + CRC×2)
+  *         2. 从站地址匹配检查
+  *         3. 功能码检查 (FC=0x03 为正常响应，FC=0x83 为异常响应，静默丢弃)
+  *         4. 数据字节数与期望值匹配检查
+  *         5. 实际帧长度与期望长度匹配检查
+  *         6. CRC16 校验
+  *         7. 提取寄存器值 (大端序)
+  * @retval true: 解析成功，mb_reg_val 已更新
+  *         false: 解析失败 (帧不完整/地址不匹配/CRC错误等)
+  */
+static bool parse_modbus_response(void)
+{
+    /* 检查最小帧长度: 地址(1) + FC(1) + 字节数(1) + CRC(2) = 5 */
+    if (mb_rx_idx < 5) return false;
+
+    /* 检查从站地址是否匹配 */
+    if (mb_rx_buf[0] != MODBUS_RTU_SLAVE_ADDR) return false;
+
+    /* 检查功能码是否为 0x03 (正常响应); 0x83 为异常响应，静默丢弃 */
+    if (mb_rx_buf[1] != 0x03) return false;
+
+    /* 检查数据字节数是否与期望值匹配 (寄存器数量 × 2) */
+    uint8_t byte_count = mb_rx_buf[2];
+    if (byte_count != (MODBUS_RTU_REG_QTY * 2)) return false;
+
+    /* 计算期望帧总长度: 地址(1) + FC(1) + 字节数(1) + 数据 + CRC(2) */
+    uint16_t expected_len = 3 + byte_count + 2;
+    if (mb_rx_idx < expected_len) return false;
+
+    /* 提取并验证 CRC16 (低字节在前) */
+    uint16_t crc_received = (uint16_t)mb_rx_buf[expected_len - 2]
+                          | ((uint16_t)mb_rx_buf[expected_len - 1] << 8);
+    uint16_t crc_calc = modbus_crc16(mb_rx_buf, expected_len - 2);
+    if (crc_received != crc_calc) return false;
+
+    /* 提取寄存器值 (大端序: 高字节在前) */
+    mb_reg_val = ((uint16_t)mb_rx_buf[3] << 8) | mb_rx_buf[4];
+    return true;
+}
+
+/* ================================================================
+ *  公共函数实现
+ * ================================================================ */
+
+/**
+  * @brief  Modbus RTU Master 模块初始化
+  * @note   将状态机重置为 IDLE 状态，清空所有缓冲区和状态变量。
+  *         mb_alarm_last 初始化为 0xFF，使得首次轮询结果不会触发变化通知
+  *         (main.c 中通过 g_last_alarm_state == 0xFF 判断跳过首次上报)
+  */
+void ModbusRTU_Master_Init(void)
+{
+    mb_state = MB_STATE_IDLE;
+    mb_state_tick = HAL_GetTick();
+    mb_last_poll_tick = HAL_GetTick();
+    mb_rx_idx = 0;
+    mb_alarm_state = 0;
+    mb_alarm_last = 0xFF;
+    mb_reg_val = 0;
+    ignore_echo_until = 0;
+}
+
+/**
+  * @brief  Modbus RTU Master 主任务函数
+  * @note   在主循环中周期性调用，驱动四状态轮询状态机:
+  *
+  *         IDLE:          等待轮询间隔 (MODBUS_RTU_POLL_INTERVAL = 1000ms)
+  *                        间隔到达后切换到 WAIT_POLL
+  *
+  *         WAIT_POLL:     立即发送 Modbus RTU 请求帧
+  *                        发送完成后切换到 WAIT_RESPONSE
+  *
+  *         WAIT_RESPONSE: 等待从站响应
+  *                        - 帧内字符超时到达 → 切换到 PROCESS 解析
+  *                        - 响应总超时到达 → 丢弃本次，回到 IDLE
+  *
+  *         PROCESS:       解析响应帧
+  *                        - 解析成功 → 更新 mb_alarm_state
+  *                        - 解析失败 → 静默丢弃
+  *                        处理完成后回到 IDLE
+  *
+  *         报警变化上报由 main.c 负责，本模块仅更新 mb_alarm_state
+  */
+void ModbusRTU_Master_Task(void)
+{
+    switch (mb_state) {
+
+    /* ---- 空闲状态: 等待轮询间隔到达 ---- */
+    case MB_STATE_IDLE:
+        if ((int32_t)(HAL_GetTick() - mb_last_poll_tick) >= MODBUS_RTU_POLL_INTERVAL) {
+            mb_last_poll_tick = HAL_GetTick();
+            mb_state = MB_STATE_WAIT_POLL;
+            mb_state_tick = HAL_GetTick();
+        }
+        break;
+
+    /* ---- 准备发送状态: 构造并发送请求帧 ---- */
+    case MB_STATE_WAIT_POLL:
+        send_modbus_request();
+        mb_state = MB_STATE_WAIT_RESPONSE;
+        mb_state_tick = HAL_GetTick();
+        break;
+
+    /* ---- 等待响应状态: 等待从站响应或超时 ---- */
+    case MB_STATE_WAIT_RESPONSE:
+        /* 帧内字符超时: 已接收数据且最后一个字节之后超过间隔时间，
+         * 认为一帧数据接收完成 */
+        if (mb_rx_idx > 0 && (int32_t)(HAL_GetTick() - mb_rx_last_byte_tick) > MODBUS_RTU_INTER_CHAR_TIMEOUT) {
+            mb_state = MB_STATE_PROCESS;
+            break;
+        }
+        /* 响应总超时: 自发送请求后超过 MODBUS_RTU_RESP_TIMEOUT 仍未收到完整帧，
+         * 丢弃本次轮询，回到 IDLE 等待下次 */
+        if ((int32_t)(HAL_GetTick() - mb_state_tick) > MODBUS_RTU_RESP_TIMEOUT) {
+            mb_state = MB_STATE_IDLE;
+        }
+        break;
+
+    /* ---- 处理状态: 解析响应帧，更新报警状态 ---- */
+    case MB_STATE_PROCESS:
+        if (parse_modbus_response()) {
+            /* 解析成功: 从寄存器值提取报警位 */
+            mb_alarm_state = extract_alarm_bits(mb_reg_val);
+            if (mb_alarm_state != mb_alarm_last) {
+                /* 报警状态发生变化，更新记录值 */
+                mb_alarm_last = mb_alarm_state;
+            }
+        }
+        /* 无论解析成功与否，回到 IDLE 等待下一次轮询 */
+        mb_state = MB_STATE_IDLE;
+        break;
+
+    /* ---- 异常兜底: 未知状态强制回到 IDLE ---- */
+    default:
+        mb_state = MB_STATE_IDLE;
+        break;
+    }
+}
+
+/**
+  * @brief  向 Modbus RTU 接收缓冲区送入一个字节
+  * @note   在 UART3 接收中断回调中调用 (HAL_UART_RxCpltCallback → huart3 分支)
+  *
+  *         数据过滤逻辑:
+  *         1. 回波屏蔽: 发送请求后 MODBUS_RTU_TX_ECHO_MARGIN 毫秒内的数据全部丢弃，
+  *            避免将自身发送的请求帧回波误判为从站响应
+  *         2. 状态过滤: 仅在 WAIT_RESPONSE 状态下接收数据，
+  *            其他状态收到的数据直接丢弃
+  *         3. 缓冲区溢出保护: 接收索引超过缓冲区大小时停止写入
+  *
+  * @param  byte: 从 UART3 接收到的原始字节
+  * @retval 无
+  */
+void ModbusRTU_FeedRxByte(uint8_t byte)
+{
+    /* 屏蔽发送回波 */
+    if (HAL_GetTick() < ignore_echo_until) return;
+
+    /* 仅在等待响应状态下接收 */
+    if (mb_state != MB_STATE_WAIT_RESPONSE) return;
+
+    /* 缓冲区溢出保护 */
+    if (mb_rx_idx >= MODBUS_RTU_MAX_RX_BUF) return;
+
+    /* 存入缓冲区并更新时间戳 */
+    mb_rx_buf[mb_rx_idx++] = byte;
+    mb_rx_last_byte_tick = HAL_GetTick();
+}
+
+/**
+  * @brief  获取当前 Modbus RTU 报警状态
+  * @note   供 main.c 中的以下场景调用:
+  *         1. 变化通知: 与上次状态比较，变化时通过 PROTO_TYPE_IO (0x10) 上报
+  *         2. 心跳包: 每 30 秒将当前报警状态填入心跳 payload
+  * @retval 紧凑报警字节:
+  *         Bit0 = 火灾报警 (对应寄存器 Bit4)
+  *         Bit1 = 水密门报警 (对应寄存器 Bit5)
+  *         Bit2 = 舱底水报警 (对应寄存器 Bit6)
+  *         Bit3 = 气体检测报警 (对应寄存器 Bit7)
+  */
+uint8_t ModbusRTU_GetAlarmState(void)
+{
+    return mb_alarm_state;
+}
--- a/Core/Src/modbus_tcp_client.c
+++ b/Core/Src/modbus_tcp_client.c
@@ -0,0 +1,182 @@
+/**
+  ******************************************************************************
+  * @file    modbus_tcp_client.c
+  * @brief   Modbus TCP 客户端模块实现 (针对寄存器 40031 轮询)
+  ******************************************************************************
+  */
+
+#include "modbus_tcp_client.h"
+#include "socket.h"
+#include "wizchip_conf.h"
+#include "main.h"
+#include "debug_log.h"
+#include <string.h>
+
+/* 私有变量 */
+static uint8_t g_sn = 0;
+static modbus_client_state_t g_state = MODBUS_STATE_IDLE;
+static uint32_t g_last_tick = 0;
+static uint16_t g_transaction_id = 0;
+
+/* 保存最新的寄存器值，用于心跳上报和变化检测 */
+static uint16_t s_last_reg_val = 0xFFFF;
+
+uint16_t ModbusTCP_Get_LastRegVal(void)
+{
+    return s_last_reg_val;
+}
+
+/* 服务器信息 */
+static uint8_t dest_ip[4] = MODBUS_SERVER_IP;
+static uint16_t dest_port = MODBUS_SERVER_PORT;
+
+/**
+ * @brief  构造 Modbus TCP 请求包 (FC 03)
+ */
+static uint16_t build_read_request(uint8_t *buf, uint16_t addr, uint16_t qty)
+{
+    g_transaction_id++;
+    
+    /* MBAP Header */
+    buf[0] = (uint8_t)(g_transaction_id >> 8);
+    buf[1] = (uint8_t)(g_transaction_id & 0xFF);
+    buf[2] = 0x00; /* Protocol ID (0 for Modbus) */
+    buf[3] = 0x00;
+    buf[4] = 0x00; /* Length (6 bytes follow UnitID) */
+    buf[5] = 0x06;
+    buf[6] = MODBUS_UNIT_ID;
+    
+    /* PDU */
+    buf[7] = 0x03; /* Function Code: Read Holding Registers */
+    buf[8] = (uint8_t)(addr >> 8);
+    buf[9] = (uint8_t)(addr & 0xFF);
+    buf[10] = (uint8_t)(qty >> 8);
+    buf[11] = (uint8_t)(qty & 0xFF);
+    
+    return 12;
+}
+
+void ModbusTCP_Client_Init(uint8_t sn)
+{
+    g_sn = sn;
+    g_state = MODBUS_STATE_IDLE;
+    g_last_tick = HAL_GetTick();
+    
+    /* 动态重新加载配置，防止静态初始化带来的宏定义未生效问题 */
+    uint8_t ip[4] = MODBUS_SERVER_IP;
+    dest_ip[0] = ip[0]; dest_ip[1] = ip[1]; dest_ip[2] = ip[2]; dest_ip[3] = ip[3];
+    dest_port = MODBUS_SERVER_PORT;
+    
+    LOG_INFO("MODBUS", "Client initialized on Socket %d, Target: %d.%d.%d.%d:%d", 
+             sn, dest_ip[0], dest_ip[1], dest_ip[2], dest_ip[3], dest_port);
+}
+
+void ModbusTCP_Client_Task(void)
+{
+    uint8_t tmp_buf[128]; // 临时接收缓存
+    uint16_t len;         // 接收长度
+    int32_t ret;          // 返回值
+
+    switch (g_state)      // 客户端状态机切换
+    {
+        case MODBUS_STATE_IDLE: // 空闲状态
+            if (HAL_GetTick() - g_last_tick >= MODBUS_POLL_INTERVAL) { // 检查轮询间隔 (2秒)
+                g_state = MODBUS_STATE_CONNECTING; // 切换到连接状态
+            }
+            break;
+
+        case MODBUS_STATE_CONNECTING: // 连接中状态
+        {
+            uint8_t sr = getSn_SR(g_sn);
+            switch(sr) // 获取当前 Socket 状态
+            {
+                case SOCK_CLOSED: // 如果 Socket 已关闭
+                    // 打开 TCP 模式的 Socket，分配随机本地端口以避免冲突
+                    if (socket(g_sn, Sn_MR_TCP, 50000 + (HAL_GetTick() % 10000), 0x00) == g_sn) { 
+                        LOG_DEBUG("MODBUS", "Socket opened");
+                    }
+                    break;
+                    
+                case SOCK_INIT: // Socket 初始化成功，开始连接
+                    LOG_INFO("MODBUS", "Connecting to %d.%d.%d.%d:%d", 
+                             dest_ip[0], dest_ip[1], dest_ip[2], dest_ip[3], dest_port);
+                    ret = connect(g_sn, dest_ip, dest_port); // 发起连接请求
+                    if (ret != SOCK_OK) {
+                        LOG_ERROR("MODBUS", "Connect failed: %d", ret);
+                        close(g_sn);
+                        g_state = MODBUS_STATE_IDLE;
+                        g_last_tick = HAL_GetTick();
+                    }
+                    break;
+                
+                case SOCK_ESTABLISHED: // 连接已建立
+                    LOG_INFO("MODBUS", "TCP Connected!");
+                    g_state = MODBUS_STATE_SEND_QUERY; // 切换到发送请求状态
+                    break;
+                    
+                case SOCK_CLOSE_WAIT: // 对方已关闭连接
+                    disconnect(g_sn); // 本地断开连接
+                    break;
+                
+                default:
+                    if (HAL_GetTick() % 5000 == 0) { // 每 5 秒打印一次未处理的状态
+                        LOG_WARN("MODBUS", "Unhandled socket state: 0x%02X", sr);
+                    }
+                    break;
+            }
+            break;
+        }
+
+        case MODBUS_STATE_SEND_QUERY: // 发送查询请求状态
+            len = build_read_request(tmp_buf, TARGET_REG_ADDR, 1); // 构造 Modbus TCP FC03 报文
+            ret = send(g_sn, tmp_buf, len); // 发送 TCP 数据
+            if (ret > 0) { // 发送成功
+                LOG_DEBUG("MODBUS", "Request sent (TID: %d)", g_transaction_id);
+                g_state = MODBUS_STATE_WAIT_RESPONSE; // 切换到等待响应状态
+                g_last_tick = HAL_GetTick(); // 更新计时器
+            } else { // 发送失败
+                LOG_ERROR("MODBUS", "Send failed, reconnecting...");
+                close(g_sn); // 关闭 Socket
+                g_state = MODBUS_STATE_IDLE; // 返回空闲重试
+            }
+            break;
+
+        case MODBUS_STATE_WAIT_RESPONSE: // 等待响应状态
+            len = getSn_RX_RSR(g_sn);
+            if (len >= 9) { // 至少需要 9 字节 (MBAP 头 7 字节 + PDU 至少 2 字节)
+                if (len > sizeof(tmp_buf)) len = sizeof(tmp_buf); // 防止缓存溢出
+                ret = recv(g_sn, tmp_buf, len); // 接收数据
+                
+                /* 校验响应 (检查 MBAP 长度、功能码等) */
+                if (ret >= 9 && tmp_buf[7] == 0x03) { // 基本校验
+                    uint16_t reg_val = (tmp_buf[9] << 8) | tmp_buf[10]; // 提取寄存器值
+                    LOG_INFO("MODBUS", "Read Register %d OK: 0x%04X", TARGET_REG_ADDR + 40001, reg_val);
+                    
+                    /* 如果检测到寄存器值发生变化，才通过 433 无线立即发送 */
+                    if (reg_val != s_last_reg_val) {
+                        s_last_reg_val = reg_val; // 更新缓存的值
+                        
+                        uint8_t payload[2]; // 构造 433 负载
+                        payload[0] = tmp_buf[9]; // 寄存器高位
+                        payload[1] = tmp_buf[10]; // 寄存器低位
+                        RF433_SendPacket(PROTO_TYPE_NET, payload, 2); // 打包并通过无线发出
+                        LOG_INFO("MODBUS", "Value changed, sent over 433");
+                    }
+                } else { // 响应格式非法
+                    LOG_ERROR("MODBUS", "Invalid response format");
+                }
+                g_state = MODBUS_STATE_IDLE; // 返回空闲
+                g_last_tick = HAL_GetTick(); // 更新计时
+                
+            } else if (HAL_GetTick() - g_last_tick > 3000) { // 等待超时 (3秒)
+                LOG_WARN("MODBUS", "Response timeout");
+                close(g_sn); // 关闭连接
+                g_state = MODBUS_STATE_IDLE; // 返回空闲重试
+            }
+            break;
+
+        default: // 异常保护
+            g_state = MODBUS_STATE_IDLE;
+            break;
+    }
+}
--- a/Core/Src/uart2_print.c
+++ b/Core/Src/uart2_print.c
@@ -462,7 +462,7 @@ int fputc(int ch, FILE *f)
 {
    (void)f;
    UART2_Print_Send((uint8_t *)&ch, 1);
-    MultiUART_Send(PORT_RS485, (uint8_t *)&ch, 1); /* 增加：同时发给 UART3 */
+    // MultiUART_Send(PORT_RS485, (uint8_t *)&ch, 1); /* 增加：同时发给 UART3 */
    return ch;
 }
 #endif
@@ -471,7 +471,7 @@ int fputc(int ch, FILE *f)
 int __io_putchar(int ch)
 {
    UART2_Print_Send((uint8_t *)&ch, 1);
-    MultiUART_Send(PORT_RS485, (uint8_t *)&ch, 1); /* 增加：同时发给 UART3 */
+    // MultiUART_Send(PORT_RS485, (uint8_t *)&ch, 1); /* 增加：同时发给 UART3 */
    return ch;
 }

@@ -479,7 +479,7 @@ int _write(int file, char *ptr, int len)
 {
    (void)file;
    UART2_Print_Send((uint8_t *)ptr, len);
-    MultiUART_Send(PORT_RS485, (uint8_t *)ptr, len); /* 增加：同时发给 UART3 */
+    // MultiUART_Send(PORT_RS485, (uint8_t *)ptr, len); /* 增加：同时发给 UART3 */
    return len;
 }
 #endif
--- a/Core/Src/usart.c
+++ b/Core/Src/usart.c
@@ -100,7 +100,7 @@ void MX_USART3_UART_Init(void)

  /* USER CODE END USART3_Init 1 */
  huart3.Instance = USART3;
-  huart3.Init.BaudRate = 4800; /* 从 9600 修改为 115200 */
+  huart3.Init.BaudRate = 19200;
  huart3.Init.WordLength = UART_WORDLENGTH_8B;
  huart3.Init.StopBits = UART_STOPBITS_1;
  huart3.Init.Parity = UART_PARITY_NONE;
--- a/MDK-ARM/JLinkLog.txt
+++ b/MDK-ARM/JLinkLog.txt
@@ -1,39 +1,96 @@
-T93F8 003:309 SEGGER J-Link V6.12c Log File (0001ms, 0925ms total)
-T93F8 003:309 DLL Compiled: Dec 16 2016 17:24:18 (0001ms, 0925ms total)
-T93F8 003:309 Logging started @ 2026-01-13 12:00 (0001ms, 0925ms total)
-T93F8 003:310 JLINK_SetWarnOutHandler(...) (0000ms, 0925ms total)
-T93F8 003:310 JLINK_OpenEx(...)
-Firmware: J-Link ARM V8 compiled Nov 28 2014 13:44:46
-Hardware: V8.00
-Feature(s): RDI,FlashDL,FlashBP,JFlash,GDBC:\Program Files (x86)\SEGGER\JLink_V612c\JLinkDevices.xml evaluated successfully.WEBSRV Webserver running on local port 19080 (0078ms, 1003ms total)
-T93F8 003:310   returns O.K. (0078ms, 1003ms total)
-T93F8 003:388 JLINK_GetEmuCaps()  returns 0xB9FF7BBF (0000ms, 1003ms total)
-T93F8 003:389 JLINK_TIF_GetAvailable(...) (0000ms, 1003ms total)
-T93F8 003:389 JLINK_SetErrorOutHandler(...) (0000ms, 1003ms total)
-T93F8 003:389 JLINK_ExecCommand("ProjectFile = "C:\workfile\new_customer\boat\src\keil\E32-433TBH-SC\MDK-ARM\JLinkSettings.ini"", ...).   returns 0x00 (0000ms, 1003ms total)
-T93F8 003:389 JLINK_ExecCommand("Device = STM32F103C8", ...). Device "STM32F103C8" selected.  returns 0x00 (0001ms, 1004ms total)
-T93F8 003:390 JLINK_ExecCommand("DisableConnectionTimeout", ...).   returns 0x01 (0000ms, 1004ms total)
-T93F8 003:390 JLINK_GetHardwareVersion()  returns 0x13880 (0000ms, 1004ms total)
-T93F8 003:390 JLINK_GetDLLVersion()  returns 61203 (0000ms, 1004ms total)
-T93F8 003:390 JLINK_GetFirmwareString(...) (0000ms, 1004ms total)
-T93F8 003:390 JLINK_GetDLLVersion()  returns 61203 (0000ms, 1004ms total)
-T93F8 003:390 JLINK_GetCompileDateTime() (0000ms, 1004ms total)
-T93F8 003:390 JLINK_GetFirmwareString(...) (0000ms, 1004ms total)
-T93F8 003:390 JLINK_GetHardwareVersion()  returns 0x13880 (0000ms, 1004ms total)
-T93F8 003:390 JLINK_TIF_Select(JLINKARM_TIF_SWD)  returns 0x00 (0000ms, 1004ms total)
-T93F8 003:390 JLINK_SetSpeed(5000) (0001ms, 1005ms total)
-T93F8 003:391 JLINK_SetResetType(JLINKARM_RESET_TYPE_NORMAL)  returns JLINKARM_RESET_TYPE_NORMAL (0000ms, 1005ms total)
-T93F8 003:391 JLINK_Reset() >0x108 TIF>Found SWD-DP with ID 0x1BA01477 >0x0D TIF> >0x28 TIF> >0x0D TIF> >0x28 TIF> >0x0D TIF> >0x28 TIF> >0x0D TIF> >0x28 TIF> >0x0D TIF> >0x21 TIF> >0x0D TIF> >0x28 TIF> >0x0D TIF> >0x28 TIF> >0x0D TIF> >0x28 TIF> >0x0D TIF> >0x21 TIF> >0x0D TIF> >0x21 TIF> >0x0D TIF> >0x28 TIF> >0x0D TIF> >0x21 TIF> >0x0D TIF> >0x21 TIF> >0x0D TIF> >0x28 TIF> >0x0D TIF> >0x28 TIF> >0x0D TIF> >0x28 TIF> >0x0D TIF> >0x21 TIF> >0x0D TIF> >0x21 TIF> >0x0D TIF> >0x28 TIF> >0x0D TIF>
- >0x21 TIF> >0x0D TIF> >0x21 TIF> >0x0D TIF> >0x28 TIF> >0x0D TIF> >0x21 TIF> >0x0D TIF> >0x21 TIF> >0x0D TIF> >0x28 TIF> >0x0D TIF> >0x21 TIF> >0x0D TIF> >0x21 TIF> >0x0D TIF> >0x28 TIF> >0x0D TIF> >0x21 TIF> >0x0D TIF> >0x21 TIF> >0x108 TIF>Found SWD-DP with ID 0x1BA01477 >0x0D TIF> >0x28 TIF> >0x0D TIF> >0x28 TIF> >0x0D TIF> >0x28 TIF> >0x0D TIF> >0x28 TIF> >0x0D TIF> >0x21 TIF> >0x0D TIF> >0x28 TIF> >0x0D TIF> >0x28 TIF> >0x0D TIF> >0x21 TIF> >0x0D TIF> >0x21 TIF> >0x0D TIF> >0x21 TIF>
-AP-IDR: 0x14770011, Type: AHB-APAHB-AP ROM: 0xE00FF000 (Base addr. of first ROM table) >0x0D TIF> >0x28 TIF> >0x0D TIF> >0x28 TIF> >0x0D TIF> >0x28 TIF> >0x0D TIF> >0x21 TIF> >0x0D TIF> >0x21 TIF> >0x0D TIF> >0x28 TIF> >0x0D TIF> >0x21 TIF> >0x0D TIF> >0x21 TIF>Found Cortex-M3 r1p1, Little endian. -- CPU_ReadMem(4 bytes @ 0xE000EDF0) -- CPU_WriteMem(4 bytes @ 0xE000EDF0) -- CPU_ReadMem(4 bytes @ 0xE0002000)FPUnit: 6 code (BP) slots and 2 literal slots -- CPU_ReadMem(4 bytes @ 0xE000EDFC)
- -- CPU_WriteMem(4 bytes @ 0xE000EDFC) -- CPU_ReadMem(4 bytes @ 0xE0001000) -- CPU_WriteMem(4 bytes @ 0xE0001000) -- CPU_ReadMem(4 bytes @ 0xE000ED88) -- CPU_WriteMem(4 bytes @ 0xE000ED88) -- CPU_ReadMem(4 bytes @ 0xE000ED88) -- CPU_WriteMem(4 bytes @ 0xE000ED88)CoreSight components:ROMTbl 0 @ E00FF000 -- CPU_ReadMem(16 bytes @ 0xE00FF000) -- CPU_ReadMem(16 bytes @ 0xE000EFF0) -- CPU_ReadMem(16 bytes @ 0xE000EFE0)ROMTbl 0 [0]: FFF0F000, CID: B105E00D, PID: 001BB000 SCS
- -- CPU_ReadMem(16 bytes @ 0xE0001FF0) -- CPU_ReadMem(16 bytes @ 0xE0001FE0)ROMTbl 0 [1]: FFF02000, CID: B105E00D, PID: 001BB002 DWT -- CPU_ReadMem(16 bytes @ 0xE0002FF0) -- CPU_ReadMem(16 bytes @ 0xE0002FE0)ROMTbl 0 [2]: FFF03000, CID: B105E00D, PID: 000BB003 FPB -- CPU_ReadMem(16 bytes @ 0xE0000FF0) -- CPU_ReadMem(16 bytes @ 0xE0000FE0)ROMTbl 0 [3]: FFF01000, CID: B105E00D, PID: 001BB001 ITM -- CPU_ReadMem(16 bytes @ 0xE00FF010) -- CPU_ReadMem(16 bytes @ 0xE0040FF0)
- -- CPU_ReadMem(16 bytes @ 0xE0040FE0)ROMTbl 0 [4]: FFF41000, CID: B105900D, PID: 001BB923 TPIU-Lite -- CPU is running -- CPU_WriteMem(4 bytes @ 0xE000EDF0) -- CPU is running -- CPU_WriteMem(4 bytes @ 0xE000EDFC) >0x35 TIF> -- CPU is running -- CPU_WriteMem(4 bytes @ 0xE000ED0C) -- CPU is running -- CPU_ReadMem(4 bytes @ 0xE000EDF0) -- CPU is running -- CPU_ReadMem(4 bytes @ 0xE000EDF0) -- CPU is running -- CPU_WriteMem(4 bytes @ 0xE000EDF0) -- CPU is running -- CPU_WriteMem(4 bytes @ 0xE000EDFC)
- -- CPU is running -- CPU_ReadMem(4 bytes @ 0xE000EDF0) -- CPU_WriteMem(4 bytes @ 0xE0002000) -- CPU_ReadMem(4 bytes @ 0xE000EDFC) -- CPU_ReadMem(4 bytes @ 0xE0001000) (0051ms, 1056ms total)
-T93F8 003:442 JLINK_GetId() >0x0D TIF> >0x21 TIF>  returns 0x1BA01477 (0000ms, 1056ms total)
-T93F8 003:445 JLINK_GetFirmwareString(...) (0000ms, 1056ms total)
-T27DC 003:445 
-  ***** Error: Connection to emulator lost! (10628ms, 11684ms total)
-T93F8 1481:830 JLINK_Close() (0011ms, 1067ms total)
-T93F8 1481:830  (0011ms, 1067ms total)
-T93F8 1481:830 Closed (0011ms, 1067ms total)
+T12E4 000:338.660   SEGGER J-Link V9.10 Log File
+T12E4 000:339.144   DLL Compiled: Jan 14 2026 11:30:41
+T12E4 000:339.176   Logging started @ 2026-05-27 07:36
+T12E4 000:339.202   Process: C:\Keil_v5\UV4\UV4.exe
+T12E4 000:339.242 - 339.228ms 
+T12E4 000:339.287 JLINK_SetWarnOutHandler(...)
+T12E4 000:339.314 - 0.033ms 
+T12E4 000:339.347 JLINK_OpenEx(...)
+T12E4 000:353.064   Firmware: J-Link ARM-OB STM32 compiled Aug 22 2012 19:52:04
+T12E4 000:354.044   Firmware: J-Link ARM-OB STM32 compiled Aug 22 2012 19:52:04
+T12E4 000:355.768   Hardware: V7.00
+T12E4 000:355.798   S/N: 20090928
+T12E4 000:355.818   OEM: SEGGER
+T12E4 000:355.839   Feature(s): RDI,FlashDL,FlashBP,JFlash,GDBFull
+T12E4 000:356.335   Bootloader: (FW returned invalid version)
+T12E4 000:357.137   TELNET listener socket opened on port 19021
+T12E4 000:357.441   WEBSRV WEBSRV_Init(): Starting webserver thread(s)
+T12E4 000:357.719   WEBSRV Webserver running on local port 19080
+T12E4 000:357.956   Looking for J-Link GUI Server exe at: C:\Keil_v5\ARM\Segger\JLinkGUIServer.exe
+T12E4 000:358.100   Looking for J-Link GUI Server exe at: C:\Program Files\SEGGER\JLink_V910\JLinkGUIServer.exe
+T12E4 000:665.738   Failed to connect to J-Link GUI Server.
+T12E4 000:665.806 - 326.445ms returns "O.K."
+T12E4 000:665.841 JLINK_GetEmuCaps()
+T12E4 000:665.865 - 0.017ms returns 0x88EA5833
+T12E4 000:665.890 JLINK_TIF_GetAvailable(...)
+T12E4 000:666.130 - 0.239ms 
+T12E4 000:666.169 JLINK_SetErrorOutHandler(...)
+T12E4 000:666.186 - 0.016ms 
+T12E4 000:666.242 JLINK_ExecCommand("ProjectFile = "C:\workfile\104_BOAT_DTU\software\TARGET_BOARD_E32-433TBH-SC\MDK-ARM\JLinkSettings.ini"", ...). 
+T12E4 000:710.711   Ref file found at: C:\Keil_v5\ARM\Segger\JLinkDevices.ref
+T12E4 000:710.971   REF file references invalid XML file: C:\Program Files\SEGGER\JLink_V910\JLinkDevices.xml
+T12E4 000:712.629 - 46.391ms returns 0x00
+T12E4 000:718.910 JLINK_ExecCommand("Device = STM32F103C8", ...). 
+T12E4 000:725.238   Device "STM32F103C8" selected.
+T12E4 000:725.669 - 6.734ms returns 0x00
+T12E4 000:725.692 JLINK_ExecCommand("DisableConnectionTimeout", ...). 
+T12E4 000:725.734   ERROR: Unknown command
+T12E4 000:725.755 - 0.034ms returns 0x01
+T12E4 000:725.769 JLINK_GetHardwareVersion()
+T12E4 000:725.783 - 0.010ms returns 70000
+T12E4 000:725.795 JLINK_GetDLLVersion()
+T12E4 000:725.805 - 0.009ms returns 91000
+T12E4 000:725.817 JLINK_GetOEMString(...)
+T12E4 000:725.830 JLINK_GetFirmwareString(...)
+T12E4 000:725.841 - 0.010ms 
+T12E4 000:742.420 JLINK_GetDLLVersion()
+T12E4 000:742.460 - 0.040ms returns 91000
+T12E4 000:742.467 JLINK_GetCompileDateTime()
+T12E4 000:742.472 - 0.005ms 
+T12E4 000:745.608 JLINK_GetFirmwareString(...)
+T12E4 000:745.622 - 0.014ms 
+T12E4 000:748.507 JLINK_GetHardwareVersion()
+T12E4 000:748.517 - 0.010ms returns 70000
+T12E4 000:751.460 JLINK_GetSN()
+T12E4 000:751.470 - 0.010ms returns 20090928
+T12E4 000:754.303 JLINK_GetOEMString(...)
+T12E4 000:762.434 JLINK_TIF_Select(JLINKARM_TIF_JTAG)
+T12E4 000:764.029 - 1.599ms returns 0x00
+T12E4 000:764.045 JLINK_HasError()
+T12E4 000:764.056 JLINK_SetSpeed(5000)
+T12E4 000:764.128 - 0.073ms 
+T12E4 000:764.141 JLINK_GetIdData(pIdData)
+T12E4 000:767.538   InitTarget() start
+T12E4 000:767.551    J-Link Script File: Executing InitTarget()
+T12E4 000:770.631   JTAG selected. Identifying JTAG Chain...
+T12E4 000:775.258   Could not measure total IR len. TDO is constant high.
+T12E4 000:778.999   Error: Scanning JTAG chain failed.
+T12E4 000:782.127   Can not attach to CPU. Trying connect under reset.
+T12E4 000:836.606   JTAG selected. Identifying JTAG Chain...
+T12E4 000:841.663   Could not measure total IR len. TDO is constant high.
+T12E4 000:845.751   Error: Scanning JTAG chain failed.
+T12E4 000:850.185   Connecting to CPU via connect under reset failed.
+T12E4 000:901.266   
+  ***** Error: 
+T12E4 000:901.339   J-Link script file function InitTarget() returned with error code -1
+T12E4 000:918.753   InitTarget() end - Took 133ms
+T12E4 000:935.880   Connect failed. Resetting via Reset pin and trying again.
+T12E4 001:014.455   InitTarget() start
+T12E4 001:014.542    J-Link Script File: Executing InitTarget()
+T12E4 001:031.499   JTAG selected. Identifying JTAG Chain...
+T12E4 001:057.121   Could not measure total IR len. TDO is constant high.
+T12E4 001:073.844   Error: Scanning JTAG chain failed.
+T12E4 001:082.649   Can not attach to CPU. Trying connect under reset.
+T12E4 001:137.329   JTAG selected. Identifying JTAG Chain...
+T12E4 001:142.365   Could not measure total IR len. TDO is constant high.
+T12E4 001:146.281   Error: Scanning JTAG chain failed.
+T12E4 001:149.924   Connecting to CPU via connect under reset failed.
+T12E4 001:200.729   
+  ***** Error: 
+T12E4 001:200.798   J-Link script file function InitTarget() returned with error code -1
+T12E4 001:214.161   InitTarget() end - Took 186ms
+T12E4 001:214.221 - 450.078ms 
+T12E4 002:651.160 JLINK_Close()
+T12E4 002:663.458 - 12.300ms
+T12E4 002:663.478   
+T12E4 002:663.483   Closed
--- a/MDK-ARM/project.uvguix.edison
+++ b/MDK-ARM/project.uvguix.edison
--- a/MDK-ARM/project.uvprojx
+++ b/MDK-ARM/project.uvprojx
@@ -81,7 +81,7 @@
          </BeforeMake>
          <AfterMake>
            <RunUserProg1>0</RunUserProg1>
-            <RunUserProg2>1</RunUserProg2>
+            <RunUserProg2>0</RunUserProg2>
            <UserProg1Name></UserProg1Name>
            <UserProg2Name></UserProg2Name>
            <UserProg1Dos16Mode>0</UserProg1Dos16Mode>
@@ -353,7 +353,7 @@
            <NoWarn>0</NoWarn>
            <uSurpInc>0</uSurpInc>
            <useXO>0</useXO>
-            <ClangAsOpt>1</ClangAsOpt>
+            <ClangAsOpt>4</ClangAsOpt>
            <VariousControls>
              <MiscControls></MiscControls>
              <Define></Define>
@@ -414,6 +414,11 @@
              <FileType>1</FileType>
              <FilePath>../Core/Src/main.c</FilePath>
            </File>
+            <File>
+              <FileName>modbus_tcp_client.c</FileName>
+              <FileType>1</FileType>
+              <FilePath>../Core/Src/modbus_tcp_client.c</FilePath>
+            </File>
            <File>
              <FileName>gpio.c</FileName>
              <FileType>1</FileType>
@@ -526,14 +531,9 @@
              <FilePath>..\Core\Src\multi_uart_router.c</FilePath>
            </File>
            <File>
-              <FileName>uart3_passthrough.c</FileName>
+              <FileName>modbus_rtu_master.c</FileName>
              <FileType>1</FileType>
-              <FilePath>..\Core\Src\uart3_passthrough.c</FilePath>
-            </File>
-            <File>
-              <FileName>uart3_protocol_discriminator.c</FileName>
-              <FileType>1</FileType>
-              <FilePath>..\Core\Src\uart3_protocol_discriminator.c</FilePath>
+              <FilePath>..\Core\Src\modbus_rtu_master.c</FilePath>
            </File>
            <File>
              <FileName>tim.c</FileName>
--- a/MDK-ARM/project/project.lnp
+++ b/MDK-ARM/project/project.lnp
@@ -4,6 +4,7 @@
 "project\rf433_rx_app.o"
 "project\rf433_tx_app.o"
 "project\main.o"
+"project\modbus_tcp_client.o"
 "project\gpio.o"
 "project\spi.o"
 "project\usart.o"
@@ -16,8 +17,7 @@
 "project\cmd_router.o"
 "project\debug_log.o"
 "project\multi_uart_router.o"
-"project\uart3_passthrough.o"
-"project\uart3_protocol_discriminator.o"
+"project\modbus_rtu_master.o"
 "project\tim.o"
 "project\stm32f1xx_hal_gpio_ex.o"
 "project\stm32f1xx_hal_spi.o"
--- a/MDK-ARM/project/project_sct.Bak
+++ b/MDK-ARM/project/project_sct.Bak
@@ -0,0 +1,15 @@
+; *************************************************************
+; *** Scatter-Loading Description File generated by uVision ***
+; *************************************************************
+
+LR_IROM1 0x08000000 0x00010000  {    ; load region size_region
+  ER_IROM1 0x08000000 0x00010000  {  ; load address = execution address
+   *.o (RESET, +First)
+   *(InRoot$$Sections)
+   .ANY (+RO)
+  }
+  RW_IRAM1 0x20000000 0x00005000  {  ; RW data
+   .ANY (+RW +ZI)
+  }
+}
+
--- a/User/user_main/user_main.c
+++ b/User/user_main/user_main.c
@@ -4,6 +4,7 @@
 #include "wizchip_conf.h"
 #include "wiz_interface.h"
 #include "loopback.h"
+#include "main.h"

 /*wizchip->STM32 Hardware Pin define*/
 //	wizchip_SCS    --->     STM32_GPIOD7
@@ -16,12 +17,16 @@
 /* Define network information */
 wiz_NetInfo default_net_info = {
    .mac = {0x00, 0x08, 0xdc, 0x12, 0x22, 0x12},
+#if TEST_A701
    .ip = {192, 168, 6, 212},
-    .gw = {192, 168, 6, 1},
+    .gw = {192, 168, 0, 1},
+#else
+    .ip = {192, 168, 0, 5},
+    .gw = {192, 168, 0, 1},
+#endif
    .sn = {255, 255, 255, 0},
    .dns = {8, 8, 8, 8},
    .dhcp = NETINFO_STATIC
-    //.dhcp = NETINFO_STATIC  //static ip
 };
 uint16_t local_port = 8000;
 uint8_t ethernet_buf[ETHERNET_BUF_MAX_SIZE] = {0};
--- a/docs/.~lock.多功能巡逻船阀门遥控系统通讯协议（至无人值守系统）20260509.xlsx#
+++ b/docs/.~lock.多功能巡逻船阀门遥控系统通讯协议（至无人值守系统）20260509.xlsx#
@@ -0,0 +1 @@
+,DESKTOP-0S8JI7H/xtell,DESKTOP-0S8JI7H,12.05.2026 14:51,file:///C:/Users/xtell/AppData/Roaming/LibreOffice/4;
--- a/docs/ModbusSlaveSetup64Bit.exe
+++ b/docs/ModbusSlaveSetup64Bit.exe
--- a/docs/Modbus_RTU原始数据来源.pdf
+++ b/docs/Modbus_RTU原始数据来源.pdf
--- a/docs/Modbus_RTU报文
+++ b/docs/Modbus_RTU报文
@@ -0,0 +1,214 @@
+# Modbus RTU 报文说明
+
+本文档描述 STM32 通过 RS485 接口轮询 Noris AMS 模块的 Modbus RTU 通信协议，
+以及报警数据如何通过 RF433 无线上报。
+
+
+# 测试方法
+
+下载docs/ModbusSlaveSetup64Bit.exe，配置从站地址为 1，波特率为 19200，通过连接 RS485 串口连接可查看 Modbus RTU 报文。
+
+---
+
+## 1. Modbus RTU 请求帧 (MCU → Noris AMS)
+
+```text
+01  03  04  88  00  01  C5  D3
+--  --  --  --  --  --  --  --
+ |   |   |   |   |   |   |   |
+ |   |   |   |   |   |   |   +-- CRC16 低字节
+ |   |   |   |   |   |   +------ CRC16 高字节
+ |   |   |   |   |   +---------- 读取数量 = 1 个寄存器 (00 01)
+ |   |   |   +------------------ 寄存器起始地址 = 0x0488 = 1160 (Noris 41161)
+ |   |   +---------------------- 功能码 = 0x03 (Read Holding Registers)
+ |   +-------------------------- 从站地址 = 1
+ +------------------------------ 固定从站地址
+```
+
+- 帧长度: 8 字节
+- 发送间隔: 1000ms (MODBUS_RTU_POLL_INTERVAL)
+- 发送方式: HAL_UART_Transmit() 阻塞发送, @19200bps 约 4.2ms
+
+---
+
+## 2. Modbus RTU 正常响应帧 (Noris AMS → MCU)
+
+```text
+01  03  02  00  F0  B8  47
+--  --  --  --  --  --  --
+ |   |   |   |   |   |   |
+ |   |   |   |   |   |   +-- CRC16 高字节
+ |   |   |   |   |   +------ CRC16 低字节
+ |   |   |   |   +---------- 寄存器值低字节 = 0xF0
+ |   |   |   +-------------- 寄存器值高字节 = 0x00 (大端序)
+ |   |   +------------------ 数据字节数 = 2 (1个寄存器 × 2字节)
+ |   +---------------------- 功能码 = 0x03 (正常响应)
+ +-------------------------- 从站地址 = 1
+```
+
+- 帧长度: 7 字节
+- 寄存器值: 0x00F0 (大端序)
+
+---
+
+## 3. 寄存器值 → 报警位映射
+
+寄存器 41161 值为 0x00F0 时的位分布:
+
+```text
+Bit:  15 14 13 12 11 10  9  8  7  6  5  4  3  2  1  0
+       0  0  0  0  0  0  0  0  1  1  1  1  0  0  0  0
+                                  ↑  ↑  ↑  ↑
+                                  │  │  │  └─ Bit4: 火灾综合报警 (Fire)
+                                  │  │  └──── Bit5: 水密门综合报警 (Door)
+                                  │  └─────── Bit6: 舱底水综合报警 (Bilge)
+                                  └────────── Bit7: 气体检测综合报警 (Gas)
+```
+
+提取宏定义 (modbus_rtu_master.h):
+```c
+NORIS_FIRE_ALARM(reg)  = (reg >> 4) & 1   // Bit4 → 报警字节 Bit0
+NORIS_DOOR_ALARM(reg)  = (reg >> 5) & 1   // Bit5 → 报警字节 Bit1
+NORIS_BILGE_ALARM(reg) = (reg >> 6) & 1   // Bit6 → 报警字节 Bit2
+NORIS_GAS_ALARM(reg)   = (reg >> 7) & 1   // Bit7 → 报警字节 Bit3
+```
+
+映射后的紧凑报警字节 (0x00F0 → 0x0F):
+
+```text
+Bit:  7  6  5  4  3  2  1  0
+       0  0  0  0  1  1  1  1
+                      ↑  ↑  ↑  ↑
+                      │  │  │  └─ Bit0: 火灾报警
+                      │  │  └──── Bit1: 水密门报警
+                      │  └─────── Bit2: 舱底水报警
+                      └────────── Bit3: 气体检测报警
+```
+
+---
+
+## 4. 报警状态变化上报 (主动上报, Type 0x10)
+
+当 Modbus RTU 报警状态发生变化时，立即发送此包。
+格式与原 DI 变化通知完全一致，上位机代码无需修改。
+
+```text
+AA  10  03  ID  XX  SUM
+--  --  --  --  --  ---
+ |   |   |   |   |   |
+ |   |   |   |   |   +-- 校验和
+ |   |   |   |   +------ 报警状态字节 (见第3节报警字节定义)
+ |   |   |   +---------- 本机设备 ID
+ |   |   +-------------- 长度固定为 0x03 (ID + 1字节状态 + SUM)
+ |   +------------------ 类型标识：0x10 (I/O Data)
+ +---------------------- 固定起始符
+```
+
+示例 (设备ID=105, 报警=0x0F):
+```text
+AA 10 03 69 0F [SUM]
+```
+
+触发条件: Modbus RTU 轮询到报警状态变化，且非首次轮询结果。
+
+---
+
+## 5. 系统心跳包 (30秒/次, Type 0xAA)
+
+```text
+AA  AA  09  ID  [SEQ_H] [SEQ_L]  [FW_H] [FW_L]  [RTU]  [TCP_H] [TCP_L]  SUM
+--  --  --  --  ---------------  -------------   ----  ---------------   ---
+ |   |   |   |         |              |           |          |          |
+ |   |   |   |         |              |           |          |          +-- 校验和
+ |   |   |   |         |              |           |          +------------- Modbus TCP 寄存器值
+ |   |   |   |         |              |           +------------------------ Modbus RTU 报警状态
+ |   |   |   |         |              |                                     Bit0:火灾 Bit1:水密门
+ |   |   |   |         |              |                                     Bit2:舱底水 Bit3:气体检测
+ |   |   |   |         |              +------------------------------------ 固件版本编码
+ |   |   |   |         +--------------------------------------------------- 序列号 (0-65535)
+ |   |   |   +------------------------------------------------------------- 本机设备 ID
+ |   |   +----------------------------------------------------------------- LEN = 9
+ |   +--------------------------------------------------------------------- 类型 0xAA
+ +------------------------------------------------------------------------- 固定起始符
+```
+
+Payload 字段说明:
+
+| 偏移 | 字段     | 长度 | 说明 |
+|------|----------|------|------|
+| 0-1  | SEQ      | 2    | 序列号 (16-bit 大端, 0-65535 循环自增) |
+| 2-3  | FW       | 2    | 固件版本编码 (MAKE_XTELL_CODE 宏) |
+| 4    | RTU      | 1    | Modbus RTU 报警状态字节 (原 DI 状态位，现替换为报警位) |
+| 5-6  | TCP      | 2    | Modbus TCP 最后寄存器值 (0xFFFF 表示无效) |
+
+---
+
+## 6. Modbus RTU 异常响应帧 (参考)
+
+如果从站返回异常:
+
+```text
+01  83  02  C0  F1
+--  --  --  --  --
+ |   |   |   |   |
+ |   |   |   |   +-- CRC16 校验
+ |   |   |   +------ 异常码 = 02 (非法寄存器地址)
+ |   |   +---------- 功能码 + 0x80 (异常标志, 0x03 → 0x83)
+ |   +-------------- 从站地址
+ +------------------
+```
+
+处理: 异常响应 FC ≠ 0x03，被 parse_modbus_response() 中
+mb_rx_buf[1] != 0x03 判断拦截，静默丢弃。
+
+---
+
+## 7. 状态机与轮询时序
+
+### 7.1 状态机
+
+```text
+IDLE ──[1000ms到]──> WAIT_POLL ──[立即发送]──> WAIT_RESPONSE
+  ↑                                              │
+  │                                ┌─────────────┤
+  │                                │             │
+  │                          [帧接收完成]    [超时500ms]
+  │                                │             │
+  └──────────── PROCESS ←─────────┘             │
+                 │                                │
+                 │  (解析+更新报警)                │
+                 └────────────────────────────────┘
+```
+
+### 7.2 轮询时序示例
+
+```text
+时间  0ms        1000ms       2000ms       3000ms
+      │            │            │            │
+T0    ├─TX(8B,4ms)
+      ├─RX(7B,4ms)
+      ├─解析
+      │
+T1                 ├─TX
+                   ├─RX
+                   ├─解析
+                   │
+T2                               ├─TX
+                                 ├─超时500ms
+                                 ├─回IDLE
+                                 │
+T3                                              ├─TX
+                                                ├─RX
+                                                ├─解析
+```
+
+每秒一个完整轮询周期: 发送(~4ms) + 等响应(~10ms) + 解析(<1ms) ≈ 15ms，其余 985ms 空闲。
+
+### 7.3 关键超时参数
+
+| 参数 | 值 | 说明 |
+|------|------|------|
+| MODBUS_RTU_POLL_INTERVAL | 1000ms | 轮询间隔 |
+| MODBUS_RTU_RESP_TIMEOUT | 500ms | 响应超时 |
+| MODBUS_RTU_INTER_CHAR_TIMEOUT | 10ms | 帧内字符间隔超时 |
+| MODBUS_RTU_TX_ECHO_MARGIN | 10ms | 发送回波屏蔽时间 |
--- a/docs/temp.zip
+++ b/docs/temp.zip
--- a/docs/xlsx_temp/[Content_Types].xml
+++ b/docs/xlsx_temp/[Content_Types].xml
@@ -0,0 +1,2 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<Types xmlns="http://schemas.openxmlformats.org/package/2006/content-types"><Default Extension="rels" ContentType="application/vnd.openxmlformats-package.relationships+xml"/><Default Extension="xml" ContentType="application/xml"/><Override PartName="/docProps/app.xml" ContentType="application/vnd.openxmlformats-officedocument.extended-properties+xml"/><Override PartName="/docProps/core.xml" ContentType="application/vnd.openxmlformats-package.core-properties+xml"/><Override PartName="/docProps/custom.xml" ContentType="application/vnd.openxmlformats-officedocument.custom-properties+xml"/><Override PartName="/xl/customStorage/customStorage.xml" ContentType="application/vnd.wps-officedocument.customStorage+xml"/><Override PartName="/xl/sharedStrings.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.sharedStrings+xml"/><Override PartName="/xl/styles.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.styles+xml"/><Override PartName="/xl/theme/theme1.xml" ContentType="application/vnd.openxmlformats-officedocument.theme+xml"/><Override PartName="/xl/workbook.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.main+xml"/><Override PartName="/xl/worksheets/sheet1.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.worksheet+xml"/></Types>
--- a/docs/xlsx_temp/_rels/.rels
+++ b/docs/xlsx_temp/_rels/.rels
@@ -0,0 +1,2 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument" Target="xl/workbook.xml"/><Relationship Id="rId3" Type="http://schemas.openxmlformats.org/package/2006/relationships/metadata/core-properties" Target="docProps/core.xml"/><Relationship Id="rId2" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/extended-properties" Target="docProps/app.xml"/><Relationship Id="rId4" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/custom-properties" Target="docProps/custom.xml"/></Relationships>
--- a/docs/xlsx_temp/docProps/app.xml
+++ b/docs/xlsx_temp/docProps/app.xml
@@ -0,0 +1,2 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<Properties xmlns="http://schemas.openxmlformats.org/officeDocument/2006/extended-properties" xmlns:vt="http://schemas.openxmlformats.org/officeDocument/2006/docPropsVTypes"><Application>Microsoft Excel</Application><HeadingPairs><vt:vector size="2" baseType="variant"><vt:variant><vt:lpstr>工作表</vt:lpstr></vt:variant><vt:variant><vt:i4>1</vt:i4></vt:variant></vt:vector></HeadingPairs><TitlesOfParts><vt:vector size="1" baseType="lpstr"><vt:lpstr>外部通讯协议</vt:lpstr></vt:vector></TitlesOfParts></Properties>
--- a/docs/xlsx_temp/docProps/core.xml
+++ b/docs/xlsx_temp/docProps/core.xml
@@ -0,0 +1,2 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<cp:coreProperties xmlns:cp="http://schemas.openxmlformats.org/package/2006/metadata/core-properties" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:dcterms="http://purl.org/dc/terms/" xmlns:dcmitype="http://purl.org/dc/dcmitype/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"><dc:creator>lkl</dc:creator><cp:lastModifiedBy>lkl</cp:lastModifiedBy><dcterms:created xsi:type="dcterms:W3CDTF">2015-06-05T18:19:00Z</dcterms:created><dcterms:modified xsi:type="dcterms:W3CDTF">2026-05-09T04:21:37Z</dcterms:modified></cp:coreProperties>
--- a/docs/xlsx_temp/docProps/custom.xml
+++ b/docs/xlsx_temp/docProps/custom.xml
@@ -0,0 +1,2 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<Properties xmlns="http://schemas.openxmlformats.org/officeDocument/2006/custom-properties" xmlns:vt="http://schemas.openxmlformats.org/officeDocument/2006/docPropsVTypes"><property fmtid="{D5CDD505-2E9C-101B-9397-08002B2CF9AE}" pid="2" name="KSOProductBuildVer"><vt:lpwstr>2052-12.8.2.21549</vt:lpwstr></property><property fmtid="{D5CDD505-2E9C-101B-9397-08002B2CF9AE}" pid="3" name="ICV"><vt:lpwstr>32722E1FC28F465CAD8A47F6421DC308_13</vt:lpwstr></property></Properties>
--- a/docs/xlsx_temp/xl/_rels/workbook.xml.rels
+++ b/docs/xlsx_temp/xl/_rels/workbook.xml.rels
@@ -0,0 +1,2 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId5" Type="http://www.wps.cn/officeDocument/2023/relationships/customStorage" Target="customStorage/customStorage.xml"/><Relationship Id="rId4" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/styles" Target="styles.xml"/><Relationship Id="rId3" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/sharedStrings" Target="sharedStrings.xml"/><Relationship Id="rId2" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/theme" Target="theme/theme1.xml"/><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/worksheet" Target="worksheets/sheet1.xml"/></Relationships>
--- a/docs/xlsx_temp/xl/customStorage/customStorage.xml
+++ b/docs/xlsx_temp/xl/customStorage/customStorage.xml
@@ -0,0 +1,2 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<customStorage xmlns="https://web.wps.cn/et/2018/main"><book/><sheets/></customStorage>
--- a/docs/xlsx_temp/xl/sharedStrings.xml
+++ b/docs/xlsx_temp/xl/sharedStrings.xml
@@ -0,0 +1,2 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<sst xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" count="419" uniqueCount="29"><si><t>Details</t></si><si><t>Address</t></si><si><t>Name</t></si><si><t>Bits</t></si><si><t>Write/Read</t></si><si><t>Definition</t></si><si><t>Type:Modbus TCP</t></si><si><t>备用</t></si><si><t>Write</t></si><si><t>IP Address:192.168.0.1</t></si><si><t>Port:502</t></si><si><t>Modbus ID:1</t></si><si><t>Modbus Offset:1</t></si><si><t>舵机舱浸水报警</t></si><si><t>Read</t></si><si><t>设备舱浸水报警</t></si><si><r><rPr><sz val="10.5"/><color theme="1"/><rFont val="宋体"/><charset val="134"/></rPr><t>机舱</t></r><r><rPr><sz val="10.5"/><color theme="1"/><rFont val="Calibri"/><charset val="134"/></rPr><t>1</t></r><r><rPr><sz val="10.5"/><color theme="1"/><rFont val="宋体"/><charset val="134"/></rPr><t>浸水报警</t></r></si><si><r><rPr><sz val="10.5"/><color theme="1"/><rFont val="宋体"/><charset val="134"/></rPr><t>机舱</t></r><r><rPr><sz val="10.5"/><color theme="1"/><rFont val="Calibri"/><charset val="134"/></rPr><t>2</t></r><r><rPr><sz val="10.5"/><color theme="1"/><rFont val="宋体"/><charset val="134"/></rPr><t>浸水报警</t></r></si><si><t>监控室浸水报警</t></si><si><t>电池舱浸水报警</t></si><si><t>船员舱浸水报警</t></si><si><r><rPr><sz val="10.5"/><color theme="1"/><rFont val="Calibri"/><charset val="134"/></rPr><t>2</t></r><r><rPr><sz val="10.5"/><color theme="1"/><rFont val="宋体"/><charset val="134"/></rPr><t>号通道浸水报警</t></r></si><si><t>艏侧推舱浸水报警</t></si><si><t>艏尖舱浸水报警</t></si><si><t>电池舱温度报警</t></si><si><t>电池舱可燃气体报警</t></si><si><t>机舱可燃气体报警</t></si><si><t>火灾报警</t></si><si><t>水密门报警</t></si></sst>
--- a/docs/xlsx_temp/xl/styles.xml
+++ b/docs/xlsx_temp/xl/styles.xml
--- a/docs/xlsx_temp/xl/theme/theme1.xml
+++ b/docs/xlsx_temp/xl/theme/theme1.xml
--- a/docs/xlsx_temp/xl/workbook.xml
+++ b/docs/xlsx_temp/xl/workbook.xml
@@ -0,0 +1,2 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<workbook xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:dbsheet="http://web.wps.cn/et/2021/dbsheet"><fileVersion appName="xl" lastEdited="3" lowestEdited="5" rupBuild="9302"/><workbookPr/><bookViews><workbookView windowWidth="29870" windowHeight="15280"/></bookViews><sheets><sheet name="外部通讯协议" sheetId="2" r:id="rId1"/></sheets><definedNames><definedName name="_xlnm._FilterDatabase" localSheetId="0" hidden="1">外部通讯协议!#REF!</definedName></definedNames><calcPr calcId="191029"/><extLst><ext uri="{B58B0392-4F1F-4190-BB64-5DF3571DCE5F}" xmlns:xcalcf="http://schemas.microsoft.com/office/spreadsheetml/2018/calcfeatures"><xcalcf:calcFeatures><xcalcf:feature name="microsoft.com:RD"/><xcalcf:feature name="microsoft.com:Single"/><xcalcf:feature name="microsoft.com:FV"/><xcalcf:feature name="microsoft.com:CNMTM"/><xcalcf:feature name="microsoft.com:LET_WF"/><xcalcf:feature name="microsoft.com:LAMBDA_WF"/><xcalcf:feature name="microsoft.com:ARRAYTEXT_WF"/></xcalcf:calcFeatures></ext></extLst></workbook>
--- a/docs/xlsx_temp/xl/worksheets/sheet1.xml
+++ b/docs/xlsx_temp/xl/worksheets/sheet1.xml
--- a/docs/多功能巡逻船阀门遥控系统通讯协议（至无人值守系统）20260509.xlsx
+++ b/docs/多功能巡逻船阀门遥控系统通讯协议（至无人值守系统）20260509.xlsx
--- a/docs/报文.md
+++ b/docs/报文.md
@@ -22,18 +22,19 @@ AA  TYPE  LEN  ID  [PAYLOAD]  SUM

 ## 2. 详细指令集定义

-### 2.1 I/O 状态变化上报 (主动上报)
-当板载 4 路数字输入 (DI) 电平发生变化时，立即发送此包。
+### 2.1 报警状态变化上报 (主动上报)
+当 Modbus RTU 轮询到的报警状态发生变化时，立即发送此包。
+格式与原 DI 变化通知完全一致，上位机代码无需修改。

 ```text
 AA  10  03  ID  XX  SUM
 --  --  --  --  --  ---
 |   |   |   |   |   |
 |   |   |   |   |   +-- 校验和
- |   |   |   |   +------ I/O 状态位 (Bit0:DI1, Bit1:DI2, Bit2:DI3, Bit3:DI4)
+ |   |   |   |   +------ 报警状态字节 (Bit0:火灾, Bit1:水密门, Bit2:舱底水, Bit3:气体检测)
 |   |   |   +---------- 本机设备 ID
 |   |   +-------------- 长度固定为 0x03 (ID + 1字节状态 + SUM)
- |   +------------------ 类型标识：0x10 (I/O Data)
+ |   +------------------ 类型标识：0x10 (Alarm Data)
 +---------------------- 固定起始符
 ```

@@ -68,26 +69,43 @@ AA  55  LEN  ID  [DATA]  SUM
 ```

 ### 2.4 系统心跳包 (30秒/次)
-系统定时上报当前存活状态，包含当前的 I/O 状态及防丢包序列号。
+系统定时上报当前存活状态，包含报警状态、防丢包序列号、固件版本及 Modbus TCP 寄存器值。
+
+#### 2.4.1 标准心跳包 (7字节Payload)

 ```text
-AA  AA  05  ID  [IO] [SEQ_H] [SEQ_L]  SUM
--  --  --  --  ---- ------- -------  ---
- |   |   |   |    |      |       |     |
- |   |   |   |    |      |       |     +-- 校验和
- |   |   |   |    |      +-------+-------- 2字节序列号 (0-65535, 循环自增)
- |   |   |   |    +----------------------- 当前 4 路 I/O 状态位
- |   |   |   +---------------------------- 本机设备 ID
- |   |   +-------------------------------- 长度固定为 0x05 (ID + 3字节Payload + SUM)
- |   +------------------------------------ 类型标识：0xAA (Heartbeat)
- +---------------------------------------- 固定起始符
+AA  AA  09   ID   [SEQ_H] [SEQ_L]   [FW_H] [FW_L]   [RTU]   [TCP_H] [TCP_L]   SUM
+--  --  --   --   ---------------   -------------   -----   ---------------   ---
+ |   |   |    |          |              |            |            |           |
+ |   |   |    |          |              |            |            |           +-- 校验和
+ |   |   |    |          |              |            |            +-------------- Modbus TCP 寄存器值
+ |   |   |    |          |              |            +--------------------------- Modbus RTU 报警状态
+ |   |   |    |          |              |                                        Bit0:火灾 Bit1:水密门
+ |   |   |    |          |              |                                        Bit2:舱底水 Bit3:气体检测
+ |   |   |    |          |              +---------------------------------------- 2字节固件版本编码
+ |   |   |    |          +------------------------------------------------------- 2字节序列号 (0-65535)
+ |   |   |    +------------------------------------------------------------------ 1字节本机设备 ID
+ |   |   +----------------------------------------------------------------------- LEN = 0x09 (9)
+ |   +--------------------------------------------------------------------------- 类型 0xAA
+ +------------------------------------------------------------------------------- 固定起始符
 ```

+**Payload 字段说明：**
+| 偏移 | 字段 | 长度 | 说明 |
+|------|------|------|------|
+| 0-1 | SEQ | 2 | 2字节序列号 (0-65535, 循环自增) |
+| 2-3 | FW | 2 | 2字节固件版本编码 (MAKE_XTELL_CODE 宏定义) |
+| 4 | RTU | 1 | Modbus RTU 报警状态 (Bit0:火灾, Bit1:水密门, Bit2:舱底水, Bit3:气体检测) |
+| 5-6 | TCP | 2 | Modbus TCP 寄存器值 (0xFFFF 表示无效) |
+
 ---

-## 3. 示例说明 (假设 Device ID = 0x01)
+## 3. 示例说明 (假设 Device ID = 0x69 = 105)

-*   **心跳包示例**：`AA AA 04 01 0F 00 05 72`
-    *   表示：ID为1的设备，I/O全为高，序列号为5。
-*   **485透传示例**：`AA 48 05 01 41 42 43 44 4D`
-    *   表示：ID为1的设备，转发了 485 数据 "ABCD" (长度 4+1=5)。
+*   **报警变化通知示例**：`AA 10 03 69 0F [SUM]`
+    *   表示：ID为105的设备，报警状态 = 0x0F (火灾+水密门+舱底水+气体检测 全部激活)
+*   **心跳包示例**：`AA AA 09 69 00 05 06 41 0F 01 2C [SUM]`
+    *   表示：ID=105，序列号5，固件版本 0x0641 (2026年5月10日第1次编译)，
+    *   RTU报警=0x0F(全报警)，Modbus TCP=0x012C(300)（7字节payload）
+*   **485透传示例**：`AA 48 05 69 41 42 43 44 4D`
+    *   表示：ID为105的设备，转发了 485 数据 "ABCD" (长度 4+1=5)。
--- a/python3/modbus_client_sim.py
+++ b/python3/modbus_client_sim.py
@@ -0,0 +1,62 @@
+import socket
+import struct
+import time
+
+# 配置信息
+SERVER_IP = '127.0.0.1'  # 模拟本地回路
+PORT = 502
+UNIT_ID = 1
+REG_ADDR = 30  # 逻辑 40031
+
+def poll_register():
+    # 1. 构造 Modbus TCP 请求 (Function Code 03)
+    tid = 0x0001
+    pid = 0x0000
+    length = 6 # 后续字节长度 (UnitID 1 + PDU 5)
+    uid = UNIT_ID
+    
+    fc = 0x03
+    addr = REG_ADDR
+    qty = 1
+    
+    # [MBAP Header] + [PDU]
+    request = struct.pack('>HHHB', tid, pid, length, uid) + \
+              struct.pack('>BHH', fc, addr, qty)
+              
+    try:
+        with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
+            s.settimeout(2.0)
+            s.connect((SERVER_IP, PORT))
+            print(f"[TX] 发送请求: {request.hex(' ')}")
+            s.sendall(request)
+            
+            # 2. 接收响应
+            response = s.recv(1024)
+            if not response:
+                print("[!] 服务器关闭了连接")
+                return
+
+            print(f"[RX] 收到响应: {response.hex(' ')}")
+            
+            if len(response) >= 9: # MBAP(7) + FC(1) + ByteCount(1)
+                # 解析响应
+                header = response[:7]
+                pdu = response[7:]
+                
+                res_tid, res_pid, res_len, res_uid = struct.unpack('>HHHB', header)
+                res_fc = pdu[0]
+                byte_count = pdu[1]
+                reg_value = struct.unpack('>H', pdu[2:4])[0]
+                
+                print(f"[+] 解析成功!")
+                print(f"    - 事务ID: {res_tid}")
+                print(f"    - 寄存器 {REG_ADDR} 的值: {hex(reg_value)} ({reg_value})")
+            else:
+                print("[!] 响应长度不足")
+                
+    except Exception as e:
+        print(f"[!] 连接错误: {e}")
+
+if __name__ == "__main__":
+    print("[*] Python Modbus TCP 客户端模拟启动...")
+    poll_register()
--- a/python3/modbus_server_sim.py
+++ b/python3/modbus_server_sim.py
@@ -0,0 +1,122 @@
+import socket
+import struct
+import sys
+import msvcrt
+import datetime
+
+# 配置信息
+HOST = '0.0.0.0'  # 监听所有接口
+PORT = 502        # Modbus TCP 标准端口
+UNIT_ID = 1       # 目标 Unit ID
+
+# 模拟寄存器存储 (30号地址 -> 40031逻辑地址)
+registers = {
+    30: 0xABCD  # 初始模拟值
+}
+
+def get_time():
+    """获取当前格式化时间"""
+    return datetime.datetime.now().strftime("%Y-%m-%d %H:%M:%S.%f")[:-3]
+
+def handle_client(conn, addr):
+    print(f"[{get_time()}] [*] 客户端已连接: {addr}")
+    conn.settimeout(1.0)
+    while True:
+        try:
+            data = conn.recv(1024)
+            if not data:
+                break
+            
+            # 记录接收到的原始报文
+            print(f"[{get_time()}] [RAW] 收到原始报文: {data.hex(' ')}")
+            
+            if len(data) < 7:
+                print(f"[{get_time()}] [!] 报文长度不足 7 字节")
+                continue
+                
+            tid, pid, length, uid = struct.unpack('>HHHB', data[:7])
+            pdu = data[7:]
+            
+            if len(pdu) < 5:
+                print(f"[{get_time()}] [!] PDU 长度不足")
+                continue
+                
+            func_code = pdu[0]
+            if func_code == 0x03:
+                start_addr, qty = struct.unpack('>HH', pdu[1:5])
+                print(f"[{get_time()}] [REQ] 读取保持寄存器: 起始地址={start_addr}, 数量={qty}, UnitID={uid}")
+                
+                payload = b''
+                for i in range(qty):
+                    val = registers.get(start_addr + i, 0)
+                    payload += struct.pack('>H', val)
+                
+                resp_pdu = struct.pack('B', func_code) + struct.pack('B', len(payload)) + payload
+                resp_length = len(resp_pdu) + 1
+                resp_header = struct.pack('>HHHB', tid, pid, resp_length, uid)
+                
+                conn.sendall(resp_header + resp_pdu)
+                print(f"[{get_time()}] [RES] 已发送响应: {payload.hex(' ')}")
+            else:
+                print(f"[{get_time()}] [!] 不支持的功能码: {func_code}")
+                
+        except socket.timeout:
+            # 检查是否有退出按键
+            if msvcrt.kbhit():
+                if msvcrt.getch().decode('utf-8', errors='ignore').lower() == 'q':
+                    return True 
+            continue
+        except Exception as e:
+            print(f"[{get_time()}] [!] 错误: {e}")
+            break
+    conn.close()
+    print(f"[{get_time()}] [*] 客户端连接已断开: {addr}")
+    return False
+
+def main():
+    # 从命令行参数获取寄存器 30 的初始值
+    if len(sys.argv) > 1:
+        try:
+            val_str = sys.argv[1]
+            if val_str.startswith('0x'):
+                registers[30] = int(val_str, 16)
+            else:
+                registers[30] = int(val_str)
+        except ValueError:
+            print(f"[!] 警告: 无效的参数 '{sys.argv[1]}'，使用默认值 {hex(registers[30])}")
+
+    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
+        s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+        s.settimeout(1.0)
+        
+        try:
+            s.bind((HOST, PORT))
+        except PermissionError:
+            print(f"[!] 错误: 无法绑定 {PORT} 端口。请尝试使用管理员权限运行。")
+            return
+            
+        s.listen()
+        print(f"[{get_time()}] [*] Modbus TCP 模拟服务端启动，监听 {PORT} 端口...")
+        print(f"[{get_time()}] [*] 寄存器 30 (40031) 当前值: {hex(registers[30])}")
+        print("[*] 提示: 随时按下 'q' 键退出程序")
+        
+        should_exit = False
+        while not should_exit:
+            if msvcrt.kbhit():
+                if msvcrt.getch().decode('utf-8', errors='ignore').lower() == 'q':
+                    print("\n[*] 检测到 'q' 键，正在退出...")
+                    break
+            
+            try:
+                conn, addr = s.accept()
+                should_exit = handle_client(conn, addr)
+            except socket.timeout:
+                continue
+            except KeyboardInterrupt:
+                print("\n[*] 正在停止服务端...")
+                break
+        
+        s.close()
+
+if __name__ == "__main__":
+    main()
Author	SHA1	Message	Date
zouhaitao	9a4fb66b51	chore: 更新固件版本日期至0528，新增Modbus从站仿真工具及测试说明	2026-05-28 13:35:25 +08:00
zouhaitao	f56367b9b3	feat: DI报警改为Modbus RTU报警上报，心跳包IO位替换为RTU报警状态，添加详细中文注释	2026-05-28 13:03:28 +08:00
zouhaitao	d2c3c6c8cb	remove invalid Windows reserved filename 'nul'	2026-05-27 18:35:36 +08:00
zouhaitao	984be481c9	优化 Modbus RTU 报文说明文档	2026-05-27 18:32:21 +08:00
zouhaitao	5318c35d37	feat: RS485透传改为Modbus RTU Master轮询寄存器41161报警信号	2026-05-27 17:15:57 +08:00
edisondeng	0bc39b7944	modbus 完整测试成功，访问 python 仿真服务程序正常，433传数据出去也正常	2026-05-10 17:13:02 +08:00
edisondeng	7171f11534	feat: 心跳包新增固件版本号字段，更新协议文档	2026-05-10 11:24:49 +08:00
edisondeng	aed62f7bb4	关闭了485上的 LOG	2026-05-10 09:24:32 +08:00
edisondeng	485fb32a72	初步测试OK	2026-05-10 08:57:34 +08:00
edisondeng	ee67076ec7	暂存	2026-05-09 19:53:47 +08:00
				`@@ -0,0 +1 @@`
				`,DESKTOP-0S8JI7H/xtell,DESKTOP-0S8JI7H,12.05.2026 14:51,file:///C:/Users/xtell/AppData/Roaming/LibreOffice/4;`