Detailed explanation of HART protocol commands: easily mastering the "Digital Language" of industrial sites
HART operation commands operate at the application layer, including general, standard, and special commands.
I.The range of general commands is from 0 to 30
- 0,11: Device identification (manufacturer, device type, version)
- 1,2,3: Read measurement values
- 6: Write HART address
- 12,13,17,18: Read and write user input text information
- 14,15: Read device information (sensor serial number, sensor range upper/lower limit, alarm operation, range, transmission structure)
- 16,19: Read and write final assembly number
II.The range of general commands is from 32 to 126.
The standard command set covers 32 to 126 codes, providing most device functionality. However, codes 123 and 126 are not public—they are manufacturer-specific codes used to input unique device identifiers during production, which end users typically do not modify. These codes can also be used for direct memory read/write operations.
- 33,61,110: Read measurement values
- 34-37,44,47: Set operational variables (range, time limit, PV value, transmission function)
- 38: Reset "structural change" flag
- 39: EPROM control
- 40-42: Dialog functions (fixed current mode, self-test, reset)
- 43,45,46: Analog input/output rectification
- 48: Check peripheral device status
- 49: Write sensor serial number
- 50-56: Transmit variables
- 57,58: Unit information (flag, description, data)
- 59: Write required preamble number
- 60,62-70: Use composite analog output
- 107-109: Burst mode control
III.Introduction to Common Important Commands
The 0，11 command is designed to identify field devices, which can be labeled using either long or short structures. The response to Command 0 contains identifiers for different devices. The host then generates distinct flags to prepare for subsequent long-structure commands. In HART 4.0 and earlier versions, the transmission type code consists of two bytes: one for the manufacturer code and another for the device type code, though these two bytes may be omitted. Starting with HART 5.0, extended codes are required to represent device information, with ID numbers replacing the final pipeline number.
A host typically initiates communication with Command 0, assigning an optional address of 0, then scanning addresses 1 through 15. For devices compliant with HART 5.0 and later standards, the host may employ Command 11 with a zero-filled broadcast address and the command flag as payload, awaiting a slave device with matching flags to respond. The acknowledged Command 11 functions identically to Command 0.
HART command analysis
Example 1: Master to Slave
|
FF |
FF |
FF |
FF |
FF |
82 |
A6 |
06 |
BC |
61 |
4E |
01 |
00 |
B0 |
The above shows a message sent from the host to the slave. Now, let's examine this message in detail.
① "FF FF FF FF FF" represents the first five bytes, which serve as the preamble byte.
② The "82" is the starting byte, indicating the long-structured message sent from the host to the slave.
③ The five-byte sequence "A6 06 BC 61 4E" is an address byte, which translates to the following binary representation:
The first byte (A6) has its most significant bit (MSB) set to 1, indicating the host.
The second bit (LSB) is 0, indicating non-burst mode.
The sequence "100110" contains: 38 (manufacturer code) from Rosemount; 06 (device model code) for the 3051C model; and 12345678 (device serial number) as the unique identifier. The "01" in the fourth byte is a command byte, specifying Command 1 to read the PV value.
⑤ "00" indicates the data length. In this case, no data is present, so the value is 0.
⑥ "B0" is the check byte
Example 2: From slave to master
|
FF FF FF FF FF |
86 |
A6 06 BC 61 4E |
01 |
07 |
00 00 |
06 |
40 B0 00 00 |
45 |
The above shows a message sent from slave to master. This example is mostly similar to Example 1, except that the data length is no longer zero. Now let's explain this message in detail.
① "FF FF FF FF FF" represents the first five bytes, which serve as the preamble byte.
② The byte '86' is the starting byte, indicating the long-structured message sent from the slave to the master.
③ The five-byte sequence "A6 06 BC 61 4E" is an address byte, which translates to the following binary representation:
The first byte (A6) has its most significant bit (MSB) set to 1, indicating the host. The second bit (LSB) is 0, indicating non-burst mode. The sequence "100110" contains: 38 (manufacturer code) from Rosemount; 06 (device model code) for the 3051C model; and 12345678 (device serial number) as the unique identifier. The "01" in the fourth byte is a command byte, specifying Command 1 to read the PV value.
⑤ "07" indicates the data length, with a value of 7, meaning the data consists of 7 bytes.
⑥ "00 00" is a status bit indicating that the slave's response message to the master is correct.
⑦ "06" is the data unit, with a value of 6, representing the unit PSI.
⑧ The four-byte value "40 B0 00 00" represents a floating-point number, specifically 5.5.
⑨ The "45" is a check byte.
Example 3: Sudden Pattern
|
FF FF FF FF FF |
81 |
A6 06 BC 61 4E |
01 |
07 |
00 00 |
06 |
40 B0 00 00 |
42 |
The message above is sent by the burst mode. Below is a detailed description of the message.
① "FF FF FF FF FF" represents the first five bytes, which serve as the preamble byte.
② "81" indicates the sudden emergence of a long-term structural pattern.
③ The five-byte sequence "A6 06 BC 61 4E" is an address byte, which translates to the following binary representation:
The first byte (A6) has its most significant bit (MSB) set to 1, indicating the host. The second bit (LSB) is 0, indicating non-burst mode. The sequence "100110" contains: 38 (manufacturer code) from Rosemount; 06 (device model code) for the 3051C model; and 12345678 (device serial number) as the unique identifier. The "01" in the fourth byte is a command byte, specifying Command 1 to read the PV value.
⑤ "07" indicates the data length, with a value of 7, meaning the data consists of 7 bytes.
⑥ "00 00" is a status bit indicating that the slave's response message to the master is correct.
⑦ "06" is the data unit, with a value of 6, representing the unit PSI.
⑧ The four-byte value "40 B0 00 00" represents a floating-point number, specifically 5.5.
⑨ The "42" is a check byte.
IV.Standard HART Protocol Command Format
- The command format for reading device information is as follows:
For example, to send the command to read the device serial number, use the sequence FF FF FF FF FF 02 80 00 00 82. The command details are shown in the table below:
|
proem |
FF FF FF FF FF |
|
delimiter |
02 |
|
address |
80 |
|
order |
00 |
|
Data length |
00 |
|
check bit |
82 |
The command format returned is as follows:
For example, the returned data is FF FF FF FF FF 06 80 00 0E 00 40 FE 50 7F 06 05 01 01 08 00 6B 73 3A 30. The command annotations for this data return are shown in the table below:
|
proem |
FF FF FF FF FF |
|
delimiter |
06 |
|
address |
80 |
|
order |
00 |
|
data length |
0E |
|
data |
00 40 FE 50 7F 06 05 01 01 08 00 6B 73 3A |
|
check bit |
30 |
Data 50 is the manufacturer ID of this device, 7F is its sensor type, and 6B 73 3A is its serial number.
- Read the dynamic variable of the device
The command format is as follows:
For example, to send a command to read dynamic variables from a device, use the following command sequence: FF FF FF FF FF FF FF FF 82 50 7F 6B 73 3A 03 00 8C. The command annotations are shown in the table below:
|
proem |
FF FF FF FF FF |
|
delimiter |
82 |
|
manufacturer ID |
50 |
|
Sensor type |
7F |
|
device serial number |
6B 73 3A |
|
order |
03 |
|
data length |
00 |
|
check bit |
8C |
The command format returned is as follows:
For example, the returned data is FF FF FF FF FF 86 50 7F 6B 73 3A 0 3 1A 00 00 41 40 00 00 49 42 44 CE 10 39 41 47 CE D0 3D 44 4F CE 10 20 41 9F D7 0A E8. The command annotations for this data return are shown in the table below:
|
proem |
FF FF FF FF FF |
|
delimiter |
82 |
|
manufacturer ID |
50 |
|
Sensor type |
7F |
|
device serial number |
6B 73 3A |
|
order |
03 |
|
data length |
1A |
|
data |
00 00 41 40 00 00 49 42 44 CE 10 39 41 47 CE D0 3D 44 4F CE 10 20 41 9F D7 0A |
|
check bit |
E8 |
The returned data meanings and converted values are shown in the table below:
|
meanings |
instruction code |
Convert value |
|
current |
41 40 00 00 |
12 |
|
instantaneous delivery |
42 44 CE 10 |
49.2 |
|
per centum |
41 47 CE D0 |
12.49 |
|
Cumulative flow |
44 4F CE 10 |
831.22 |
|
temperature |
41 9F D7 0A |
19.98 |