Adaptive test method and system for modbus slave register writable range

Abstract

The application discloses a self-adaptive test method and system for a Modbus slave register writable range, and relates to the technical field of communication testing. The method comprises the following steps: storing a theoretical value range of a to-be-tested register as a first detection interval into a detection queue and backing up a current value; selecting an interval which is not marked by a global dead interval set from the queue and executing multiple detection strategies to find an anchor point; if the anchor point is found, expanding a search around the anchor point to locate a writable value range segment and storing the writable value range segment into an effective list, and meanwhile, putting the remaining interval into the queue; performing the cycle until a termination condition is met, merging all the writable value range segments in the effective list and outputting the same, and restoring the register to the backup value. The system is used for implementing the above method. The application does not need manual preset test values, realizes full coverage detection of multiple discrete writable intervals through queue division and dead interval caching, greatly reduces communication messages, automatically rolls back after testing to ensure device safety.

Description

Technical Field

[0001] This application relates to the field of communication testing technology, and in particular to an adaptive testing method and system for the writable range of Modbus slave registers. Background Technology

[0002] The Modbus protocol, a serial communication protocol widely used in industrial automation, directly impacts the writable range of the holding registers in slave devices, affecting core functions such as device parameter configuration and operational setting modification. Accurately identifying the writable value range of registers is of significant engineering importance in scenarios such as factory testing, on-site commissioning, and protocol conformance authentication.

[0003] Currently, testing methods for the writable range of Modbus slave registers are mainly divided into two categories: one is a fixed-point testing scheme based on protocol configuration and message parsing. The core idea of ​​this scheme is that testers pre-configure test cases based on the register information marked in the device protocol document or product specification, and complete the test through message parsing and numerical comparison; the other is the global traversal or single-segment continuous probing scheme commonly used in the industrial control field. This scheme does not rely on the protocol configuration file, but discovers the writable range by systematically writing to the register value range.

[0004] The aforementioned existing technical solutions have the following drawbacks: The former approach relies entirely on manually written specification configuration files, which can only verify the register addresses and values ​​marked in the documentation. This leads to the systematic omission of hidden writable ranges not documented by equipment manufacturers, resulting in a severe lack of protocol consistency test coverage. Furthermore, this approach does not design a mechanism for backing up the original register values ​​or for automatic rollback before batch write tests. The verification values ​​written during the test will permanently tamper with the equipment's operating settings, potentially causing serious safety risks such as relay protection malfunctions and inverter parameter drift. In addition, its message buffer queue is only used for classifying and storing business messages, which is completely separate from the register value range detection logic. It has no memory or filtering capability for the confirmed read-only dead zone, resulting in extremely high bus communication redundancy and low test efficiency.

[0005] The latter approach, the full traversal scheme, requires sending write commands to the entire register value range one by one and then reading back for verification. This would require tens of thousands of messages for a 16-bit register, taking tens of minutes, and hundreds of millions of messages for a 32-bit register, making it impractical and completely unsuitable for industrial mass production line testing scenarios. The single-segment continuous detection scheme widely used in industry suffers from deep-seated technical biases, assuming that the writable range of a register is a single continuous segment. This assumption stems from the characteristics of early, simple PLC devices. However, modern power protection devices, intelligent inverters, and other equipment, for safety redundancy design, generally artificially segment and isolate the writable range. The single-segment binary scheme can only identify one continuous segment, completely losing the remaining isolated segments, narrow segments, and even isolated writable points, resulting in severely distorted test results and failing equipment conformance certification.

[0006] Furthermore, none of the above solutions have a global dead zone cache memory mechanism. During the divide-and-conquer process, invalid write commands are repeatedly issued to the confirmed read-only regions, continuously occupying RS485 bus resources. Moreover, each test link is independent of the others and does not form a closed-loop adaptive test system of detection, splitting, filtering, verification, and rollback. The intelligent and refined test capabilities are seriously insufficient, making it difficult to meet the comprehensive test requirements of full coverage, high efficiency, and high security in industrial fields. Summary of the Invention

[0007] One objective of this application is to provide an adaptive testing method for Modbus slave register writable range that can address at least one of the deficiencies in the aforementioned background art.

[0008] Another objective of this application is to provide a system for implementing the above-described adaptive test method for the writable range of Modbus slave registers.

[0009] To achieve at least one of the above objectives, one aspect of this application provides an adaptive testing method for the writable range of Modbus slave registers, comprising the following steps: storing the theoretical value range of the register under test as the first probe interval in a probe queue, and backing up its current read value; selecting a probe interval not marked by the global dead interval set from the probe queue, and executing multiple probe strategies within the current probe interval to find writable values ​​as anchor points; if an anchor point is found, performing an extended search within the current probe interval centered on the anchor point, locating the writable value range segment containing the anchor point and storing it in the valid interval list, while storing the remaining interval segments of the current probe interval in the probe queue; if no anchor point is found, merging it into the global dead interval set or storing it in the probe queue according to the width of the current probe interval; cyclically executing the process of selecting the probe interval and searching for the writable value range segment until the loop termination condition is met, exiting the loop, merging all writable value range segments recorded in the valid interval list, outputting the test result to complete the test; restoring the tested register to the backed-up current read value.

[0010] Preferably, when searching for an anchor point within the current detection interval, multiple detection strategies, including first-order detection, second-order detection, third-order detection, and fourth-order detection, are executed sequentially, and subsequent detection is terminated after any order of detection is successful. Specifically, the first-order detection is configured to write the endpoint value of the theoretical value range of the register to be tested or a preset general characteristic value; the second-order detection is configured to read the original backup value of the register to be tested and immediately write it into the register; the third-order detection is configured to calculate and write the midpoint value of the current detection interval; and the fourth-order detection is configured to generate and write at least one random value within the current detection interval.

[0011] Preferably, the specific process of expanding the search to the left and right sides of the current detection interval with the anchor point as the center to locate the writable value range is as follows: starting from the anchor point, write trial values ​​successively to the left and right sides of the current detection interval at a preset step size until the write fails; on the right side of the current detection interval, perform a binary search between the last successfully written trial value and the first failed trial value to locate the maximum writable value as the right boundary value of the writable value range; on the left side of the current detection interval, perform a binary search between the last successfully written trial value and the first failed trial value to locate the minimum writable value as the left boundary value of the writable value range; wherein, the preset step size is a variable step size, adopting one of the following methods: linear change, exponential change, adaptive change, and piecewise change.

[0012] Preferably, after locating the writable value range [a, b], the current detection interval [L, R] is based on a preset safety interval. The remaining intervals are [L, a- ] and [b+ The specific process of storing the remaining interval segment into the probe queue is as follows: if L≤a- The remaining interval [L, a- Stored at the rear of the exploration team; if b+ ≤R, the remaining interval [b+ ,R] is stored at the tail of the exploration team.

[0013] Preferably, when no anchor point is found, the width of the current detection interval is compared with a preset interval width threshold; if the width of the current detection interval is less than or equal to the preset interval width threshold, it is marked as a dead interval and added to the global dead interval set; otherwise, the current detection interval is split in half and stored in the detection queue.

[0014] Preferably, the loop termination conditions include an empty probe queue, the number of loops reaching the preset maximum number of loops, and the theoretical value range of the current register under test being completely covered by the global dead interval set; the loop exits when any of the termination conditions are met.

[0015] Preferably, the specific process for outputting the test results is as follows: all writable value ranges recorded in the list of valid intervals are sorted in ascending order according to their left boundary values; if the interval between two adjacent writable value ranges is less than or equal to the preset safety interval, the two are merged; for each merged writable value range, its left endpoint, midpoint, and right endpoint are selected to perform write-readback verification respectively; writable value ranges that are successfully verified are confirmed and included in the final output; writable value ranges that fail verification are still retained but marked as suspected intervals, and a decision on whether to retain or remove them is made after manual review.

[0016] Preferably, the specific process for restoring the registers that have completed the test is as follows: For the registers that have completed the test, the original backup value is written back and restored using the write function code of the Modbus protocol; the write-back operation is read back to verify whether the restored value is consistent with the original backup value; if the restored value is consistent with the original backup value, the read back verification is deemed successful and the register restoration is completed; if the restored value is inconsistent with the original backup value, the read back verification is deemed unsuccessful, and the write-back and read back verification operations are repeated until the read back verification is successful or the preset number of repetitions is reached.

[0017] Preferably, after each write operation is completed according to the issued write instruction, two register read-back operations are performed consecutively. The write operation is considered valid only if the two read-back values ​​are consistent with the write value.

[0018] Another aspect of this application provides a system for implementing the aforementioned adaptive testing method for the writable range of Modbus slave registers, including a Modbus communication module, a dual read / write verification module, a queue and dead-range buffer module, an anchor point detection module, a boundary retrieval module, a register state backup and recovery module, and an automatic test linkage module. The Modbus communication module is located at the system's bottom layer, encapsulating the Modbus RTU protocol stack, and is used to establish a communication connection with the external register under test, and to perform register readback and write operations. The dual read / write verification module performs two consecutive register readback operations after each write instruction is issued, and determines the write operation is valid only if both readback values ​​and the write value are consistent. The queue and dead-range buffer module maintains a probe queue and a global dead-range set. The probe queue stores the register value range to be probed, and the global dead-range set stores value ranges that have been confirmed to be completely unwritable. The anchor point detection module retrieves the current probe range from the probe queue, executes multiple probe strategies within the current probe range according to a preset priority to find writable values ​​as anchor points, and performs all probe strategies... Upon failure, a no-writable-point signal is generated; the boundary retrieval module is used to search for writable value segments and store them in the valid interval list when an anchor point is successfully found; and to merge the current probe interval into the global dead zone set or store it in the probe queue when a no-writable-point signal is received; the register state backup and recovery module is used to store the current value of the register under test as the original backup value at the start of the test, and to write the original backup value back to the corresponding register after the test is completed; the automatic test linkage module is used to control the start and stop of the anchor point detection module, the boundary retrieval module and the register backup and recovery module, and to merge all consecutive writable value segments in the valid interval list after the test is completed, and output standardized test results.

[0019] Compared with the prior art, the beneficial effects of this application are as follows: (1) This application uses a dynamic accumulation and filtering mechanism of global dead interval set to permanently cache the value range segment that has been confirmed to have no write points. Subsequent probe intervals covered by this set are automatically skipped and no more write instructions are issued. This fundamentally solves the problem of RS485 bus communication redundancy caused by repeated probes of read-only dead zones in existing schemes, and effectively saves bus bandwidth resources.

[0020] (2) This application uses a divide-and-conquer iterative queue mechanism to automatically enqueue the remaining intervals to the left and right after a writable segment is found and continue to probe. When there are no writable points, the interval is split or marked and then processed. This ensures that the complete value range is subdivided segment by segment and traversed without omission, thereby supporting the independent identification of multiple discrete writable intervals. This solves the problem of serious distortion of test results caused by the traditional single-segment binary scheme losing the remaining isolated intervals due to the incorrect assumption of a single continuous segment. The test results truly reflect the actual register permission distribution of the device.

[0021] (3) This application uses an automatic anchor point discovery and extended search mechanism to automatically locate writable value points within the complete theoretical value range and extend them outward to the entire continuous writable segment without the need for manual preset of any test values ​​or addresses. It automatically captures hidden writable intervals not marked in the specification file, effectively solving the problem of severe lack of test coverage in existing solutions. At the same time, through the two-stage strategy of anchor point discovery and boundary search, it avoids traversing every value within the writable segment one by one, greatly reducing the number of communication messages and effectively adapting to the batch automated testing scenario of the production line.

[0022] (4) This application ensures that all registers are fully restored to their pre-test state after the test is completed through a closed-loop security mechanism of backup before test and recovery after test, thereby achieving zero tampering of the operating parameters of the device under test and eliminating serious safety risks in industrial sites such as relay protection maloperation and inverter parameter drift caused by test writing. Attached Figure Description

[0023] Figure 1 This is a schematic diagram of the hardware testing architecture for this application; Figure 2 A schematic diagram illustrating the working steps of the adaptive testing method for the writable range of Modbus slave registers in this application; Figure 3 A schematic diagram illustrating the specific process of the adaptive testing method for the writable range of Modbus slave registers in this application; Figure 4 This is a flowchart illustrating the sequential execution of multiple detection strategies in this application; Figure 5 This is a flowchart illustrating the exponential-bisection boundary search process for the right boundary of the writable range segment in this application. Figure 6 This is a schematic diagram of the system architecture used in this application to implement an adaptive test method for the writable range of Modbus slave registers. Detailed Implementation

[0024] The present application will now be further described in conjunction with specific embodiments. It should be noted that, in the description of this specification, the use of terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicates that the specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms should not be construed as necessarily referring to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. In addition, those skilled in the art can combine and integrate the different embodiments or examples described in this specification.

[0025] In the description of this application, it should be noted that the terms "center", "lateral", "longitudinal", "length", "width", "thickness", "upper", "lower", "front", "rear", "left", "right", "vertical", "horizontal", "top", "bottom", "inner", "outer", "clockwise", "counterclockwise", etc., which indicate the orientation and positional relationship based on the orientation or positional relationship shown in the accompanying drawings, are only for the convenience of describing this application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and should not be construed as limiting the specific protection scope of this application.

[0026] It should be noted that the terms "first," "second," etc., in the specification and claims of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0027] In this application, unless otherwise expressly specified and limited, the terms "installation," "connection," "joining," and "fixing," etc., should be interpreted broadly. For example, they can refer to a connection, a detachable connection, or an integral part; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; they can refer to the internal communication of two components or the interaction between two components. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0028] In this application, unless otherwise expressly specified and limited, "above" or "below" the second feature can include direct contact between the first and second features, or contact between the first and second features through another feature between them. Furthermore, "above," "over," and "on top" of the second feature includes the first feature being directly above or diagonally above the second feature, or simply indicates that the first feature is at a higher horizontal level than the second feature. "Below," "below," and "under" the second feature includes the first feature being directly below or diagonally below the second feature, or simply indicates that the first feature is at a lower horizontal level than the second feature.

[0029] The terms “comprising” and “having”, and any variations thereof, in the specification and claims of this application are intended to cover non-exclusive inclusion, for example, a process, method, system, product, or device that includes a series of steps or units is not necessarily limited to those steps or units that are explicitly listed, but may include other steps or units that are not explicitly listed or that are inherent to such process, method, product, or device.

[0030] To facilitate understanding of the technical solution of this application, the test scenario of this application will be briefly introduced below with reference to the accompanying drawings.

[0031] like Figure 1 The diagram shown is a schematic of the hardware test architecture of this application, including a master test terminal, a signal conversion unit, and a Modbus slave under test.

[0032] The master test terminal primarily uses an industrial-grade PC or industrial control computer, equipped with a Windows operating system, and runs the automatic testing software implementing the technical solution of this application. The terminal is equipped with a standard RS232 serial interface, which is used to establish a physical connection with the signal conversion unit. The master test terminal is the control core of the entire test architecture, responsible for issuing Modbus read / write messages, receiving and parsing slave response frames, running core algorithms, recording test logs, and generating standardized test reports.

[0033] The signal conversion unit employs an RS232 / RS485 passive isolation converter, preferably a USB-RS485 converter. One end connects to the standard RS232 serial interface of the master test terminal via an RS232 serial cable, and the other end connects to the Modbus slave device under test via an RS485 shielded twisted-pair cable. The signal conversion unit primarily converts the RS232 single-ended signal output from the master test terminal into an RS485 differential level signal to meet the communication needs of long-distance, multi-site applications in industrial environments. It should be noted that the signal conversion unit can also communicate with the Modbus slave device under test via a wireless link based on the Modbus protocol, adapting to wireless industrial field equipment testing.

[0034] The Modbus slave devices under test include, but are not limited to, industrial equipment that supports Modbus protocol register read / write operations, such as PLC programmable controllers, microprocessor-based relay protection devices, smart power meters, new energy inverters, and RTU remote terminals. During testing, the number of Modbus slave devices under test can be one or more. For multiple Modbus slave devices under test, the signal conversion unit can be configured with an RS485 hub to connect multiple Modbus slave devices in parallel, performing register tests on multiple devices simultaneously, thus improving batch testing efficiency. The N Modbus slave devices under test can be numbered as Slave #1, Slave #2, ..., Slave #N.

[0035] The specific test logic of the above hardware test architecture is as follows: The master test terminal runs automatic test software and sends Modbus read / write messages, which are transmitted to the signal conversion unit via RS232 serial port. The signal conversion unit converts the serial signal into RS485 differential level and broadcasts it to all Modbus slave devices under test via twisted pair cable. The target Modbus slave device under test identifies and responds according to the station address in the received Modbus read / write message. The response frame is transmitted back to the master test terminal via the same link for software parsing. In scenarios equipped with an excitation source, the excitation source and the master test terminal are connected via another serial port to apply analog excitation while performing register write tests, in order to verify the writability of the register under different operating conditions.

[0036] Based on the aforementioned hardware testing architecture, one aspect of this application provides an adaptive testing method for the writable range of Modbus slave registers, such as... Figure 2 and Figure 3 As shown, one preferred embodiment includes the following steps: S100: Store the theoretical value range of the register to be tested as the first probe interval into the probe queue, and back up its current read value.

[0037] It should be understood that the theoretical value range is determined based on the data type of the register under test. For example, for a U16 type register, its theoretical value range is [0, 65535]; for an S32 type register, its theoretical value range is [-2147483648, 2147483647]. The probe queue uses a first-in, first-out (FIFO) data structure to store all sub-ranges of the register value range waiting to be tested; each element in the queue is a range tuple. The backup operation reads the current value of the register under test through the Modbus protocol's 03 function code and stores it in the backup cache as a key-value pair (address, current value). For example, for a U16 type register at address 43012, if its current value is read as 0x0100, then (43012, 0x0100) will be stored in the backup cache.

[0038] Understandably, traditional testing methods require manual pre-setting of test cases, and the original state of the device cannot be restored after the test, posing a risk of permanent parameter tampering. This step automatically enqueues the complete theoretical value range as the first probe interval, achieving zero manual configuration of the test starting point; at the same time, it backs up the current register values, providing a data foundation for the subsequent safe recovery of the device.

[0039] S200: Select a probe interval from the probe queue that is not marked by the global dead interval set, and execute multiple probe strategies within the current probe interval to find writable values ​​as anchor points.

[0040] It's important to understand that the global dead interval set is a "blacklist" cache for confirmed completely unwritable (read-only) value ranges. In actual code implementations, it's typically stored using a Red-Black Tree or IntervalTree data structure. When selecting probe intervals, pre-validation filtering can be performed using the global dead interval set. Specifically, for the current probe interval [L, R], if the global dead interval set D contains a dead interval [d1, d2] satisfying d1≤L and R≤d2, it means the current probe interval is covered by the global dead interval set, and it's discarded, with the next probe interval selected from the probe queue. Note that if the width W = R - L + 1 < 2 for the current probe interval [L, R], it means there are no writable integer points in the current probe interval, and it also needs to be discarded. Only probe intervals that pass the pre-validation filtering can undergo the anchor point discovery process.

[0041] Understandably, traditional testing methods lack memory for confirmed read-only dead zones, repeatedly issuing invalid write commands, resulting in high bus communication redundancy and low testing efficiency. This step, through pre-verification filtering of the global dead zone set, ensures that any probe interval completely covered by the dead zone is discarded after dequeueing and no further write commands are issued, achieving one-time confirmation and permanent skipping of dead zones, effectively saving RS485 bus bandwidth.

[0042] S300: If an anchor point is found, expand the search within the current probe interval with the anchor point as the center, locate the writable value range containing the anchor point and store it in the list of valid intervals, and store the remaining interval ranges of the current probe interval in the probe queue.

[0043] Understandably, this step automatically finds anchor points through various detection strategies, and then expands the search around the anchor points to locate complete writable segments, avoiding traversal one by one; after discovering a writable segment, the remaining intervals to the left and right of the current detection interval are enqueued respectively, creating conditions for subsequent detection of other discrete segments, achieving a balance between full coverage and high efficiency.

[0044] S400: If no anchor point is found, it is either merged into the global dead interval set or stored in the probe queue according to the width of the current probe interval.

[0045] Understandably, when all anchor point probing strategies fail, it's impossible to directly determine whether the current probe interval is a dead interval or contains a very narrow writable interval. Improper handling could lead to missing valid segments or causing excessive communication. Therefore, this step distributes traffic based on the width of the current probe interval. If the current probe interval is narrow, it's highly unlikely that it contains a very narrow writable interval, and it can be merged into the global dead interval set. If the current probe interval is wide, it's highly likely that it contains a very narrow writable interval, and it can be stored in the probe queue.

[0046] S500: The process of selecting the probe interval and searching for writable value range segments is executed cyclically until the loop termination condition is met. When the loop terminates, the loop exits, and all writable value range segments recorded in the valid interval list are merged. The test results are then output to complete the test.

[0047] S600: Restore the registers that have completed the test to the current read values ​​of the backup.

[0048] Understandably, this application uses a dynamic accumulation and filtering mechanism of a global dead interval set to permanently cache the value range segment that has been confirmed to have no write points. Subsequent probe intervals covered by this set are automatically skipped and no write commands are issued. This fundamentally solves the problem of RS485 bus communication redundancy caused by repeated probes of read-only dead zones in existing solutions, and effectively saves bus bandwidth resources.

[0049] This application employs a divide-and-conquer iterative queue mechanism. After discovering a writable segment, it automatically enqueues the remaining intervals to its left and right to continue probing. When no writable points are found, the interval is split or marked before further processing. This ensures that the complete value range is subdivided segment by segment without omissions, thereby supporting the independent identification of multiple discrete writable intervals. It solves the problem of severe distortion in test results caused by the traditional single-segment binary search scheme, which loses the remaining isolated intervals due to the incorrect assumption of a single continuous segment. The test results truly reflect the actual register permission distribution of the device.

[0050] The application utilizes an automatic anchor point discovery and extended search mechanism, eliminating the need for manual preset of any test values ​​or addresses. It autonomously locates writable value points within the complete theoretical value range and expands outwards to the entire continuous writable segment, automatically capturing hidden writable intervals not marked in the specification file. This effectively solves the problem of severely insufficient test coverage in existing solutions. Furthermore, the two-stage strategy of anchor point discovery and boundary search avoids traversing every single value within the writable segment, significantly reducing the number of communication messages and effectively adapting to automated batch testing scenarios on production lines.

[0051] This application employs a closed-loop security mechanism of backup before testing and recovery after testing to ensure that all registers are fully restored to their pre-test state after testing, achieving zero tampering with the operating parameters of the device under test and eliminating serious safety risks in industrial settings such as relay protection malfunctions and inverter parameter drift caused by test writes.

[0052] In a specific embodiment, step S100 is an initialization operation, including queuing the theoretical value range of the register to be tested and backing up the current value, as well as cache and list initialization and control parameter setting. Specifically, the cache and list initialization process involves creating an empty global dead interval set D and an empty valid interval list V. The control parameter setting process involves loading a set of preset algorithm control parameters, including a safety interval Δ, an interval width threshold T, a maximum number of random samples K, and a maximum number of loops M. The safety interval Δ is used to isolate adjacent writable segments during interval splitting to prevent boundary overlap; the interval width threshold T is used to determine the processing strategy for narrow intervals.

[0053] It is important to understand that, for a given detection interval, maximizing the anchor point discovery probability with the fewest communication attempts is a key issue. Existing methods for randomly generating parameters inevitably suffer from data omissions, and a single detection strategy struggles to accommodate the diverse writable characteristics of different device registers. Some registers support common default values, while others only accept the currently running value; some registers have writable points distributed in the center of the interval, and some only have isolated writable points. The technical solution of this application aims to provide a hierarchical, progressive anchor point detection strategy that covers all of the above scenarios with minimal communication overhead; for ease of understanding, a detailed description follows.

[0054] In a specific embodiment, when performing step S200, as follows: Figure 3 and Figure 4 As shown, when searching for anchor points within the current detection range, a four-order detection strategy, including first-order detection, second-order detection, third-order detection, and fourth-order detection, is executed in sequence, and subsequent detection is terminated after any order detection is successful.

[0055] The first-order probe is configured to write endpoint values ​​or preset general characteristic values ​​to the theoretical range of the register under test. Specifically, it sequentially writes 0, 1, the minimum theoretical range value L, and the maximum theoretical range value R; these values ​​are common default or boundary values ​​found in device documentation, have a high probability of being writable, and have extremely low communication overhead. For unsigned registers, such as the U16 register, 0 and 1 are high-probability writable values; for signed registers, such as the S16 register, -1 is also attempted. Taking the U16 register at address 43012 as an example, if the current probe interval is [0, 65535], the first-order probe sequentially attempts to write 0, 1, 0, and 65535. If writing 0 is successful, the probe immediately terminates, and the boundary retrieval phase begins with 0 as the anchor point.

[0056] The second-order probe is configured to read the original backup value of the register under test and immediately write it back to that register. Specifically, the second-order probe leverages the fact that the device's factory default value or current operating setting is almost always writable; that is, the backup value currently stored in the register is necessarily a value that the device allows to be written. Therefore, in most cases, an anchor point can be successfully generated in a single communication. For example, if the original backup value of the register is 0x0100 (i.e., 256), this value is written back to the register, and after successful writing and verification, anchor point 256 is generated.

[0057] The third-order probe is configured to calculate and write the midpoint value of the current probe interval. Specifically, the midpoint value `mid` is calculated as `mid = floor[(L + R) / 2]`, where `floor[·]` represents the floor function. For example, for the probe interval [0, 65535], the midpoint value can be calculated as 32767 using the above expression. The midpoint method can quickly locate writable points in the center region of an interval, and is especially suitable for scenarios where writable intervals are symmetrically distributed in the value range.

[0058] The fourth-order detection is configured to generate and write at least one random value within the current detection interval. Specifically, the number of random values ​​generated is limited, not exceeding a preset maximum number of random samplings K. The specific value of the maximum number of random samplings K can be set according to the actual needs of those skilled in the art, for example, K can be 3 or 5. Taking K=3 as an example, three sets of random values ​​can be randomly generated within the current detection interval and evenly distributed within the current detection interval. For example, for the detection interval [0, 65535], values ​​such as 12345, 45678, and 32768 can be randomly generated for testing. Random sampling, as a fallback strategy, can capture highly irregularly distributed, non-continuous writable points, such as isolated single-point writable values.

[0059] It should be noted that during the sequential execution of the fourth-order probing process, if any one-order probing is successful, the corresponding anchor point can be returned; if all four-order probing fails, a "no writable point" signal is returned, meaning that no anchor point was found in the current probing interval.

[0060] Understandably, this embodiment employs a hierarchical design for four-level anchor point discovery, covering the entire search space from high-probability writable values ​​to low-probability writable values. The first-level probe utilizes common default values ​​from device documentation to achieve rapid hits with extremely low overhead. The second-level probe leverages the characteristic that the current value of a register is always writable to generate high-probability anchor points. The third-level probe uses the midpoint method to quickly locate writable points in the central region of an interval. The fourth-level probe uses random sampling as a fallback strategy to capture writable points with highly irregular distributions. This tiered probing design, which stops upon success, maximizes the anchor point discovery probability with minimal communication, avoiding the problem of a single strategy completely failing on some devices. It also avoids unnecessary probe overhead and achieves adaptive matching of probe depth to device behavior.

[0061] It is important to understand that after successfully finding the anchor point, a core issue is how to efficiently and accurately locate the left and right boundaries of the entire continuous writable value range containing that anchor point. Existing single-segment binary search schemes have a fixed step size when probing boundaries, resulting in low efficiency over a large value range. The technical solution of this application aims to provide a hybrid boundary search strategy based on step size expansion and binary search convergence, balancing search speed and positioning accuracy. For ease of understanding, a detailed description will follow.

[0062] In a specific embodiment, when executing step S300, the specific process of expanding the search to the left and right sides of the current detection interval with the anchor point as the center to locate the writable value range is as follows: starting from the anchor point, write trial values ​​one by one to the left and right sides of the current detection interval with a preset variable step size until the write fails; on the right side of the current detection interval, perform a binary search between the last successfully written trial value and the first failed trial value to locate the maximum writable value as the right boundary value of the writable value range; on the left side of the current detection interval, perform a binary search between the last successfully written trial value and the first failed trial value to locate the minimum writable value as the left boundary value of the writable value range.

[0063] It should be understood that there are various ways to change the preset variable step size, such as linear, exponential, adaptive, or piecewise variations. The specific method for changing the variable step size can be selected according to the actual needs of those skilled in the art. Among these, the linear variation method results in a gradual increase in step size, suitable for scenarios lacking prior information about the boundary range. It is more conservative than the exponential method, with slightly more communication attempts, but the jump range is controllable, and it is less likely to significantly exceed the boundary due to excessively rapid step size growth. The exponential variation method results in the fastest increase in step size, with the number of communication attempts increasing logarithmically, making it particularly suitable for rapid traversal of large value ranges. The adaptive variation method is most sensitive to the detection results, allowing for real-time adjustment of the detection granularity based on the actual device response. It exhibits better robustness, especially when there are spikes at the boundaries of writable segments, such as a single non-writable point interspersed within a writable segment. However, its algorithm complexity is slightly higher than the exponential method, and the step size adjustment may be unstable. For variable step sizes employing a segmented variation approach, the growth rate combines the advantages of various step size strategies: a fast phase ensures efficiency, while a fine phase ensures accuracy. This approach is suitable for scenarios with some prior knowledge of the boundary positions, or for engineering requirements that demand a strict balance between efficiency and accuracy. To further facilitate understanding, the specific implementation methods of variable step sizes using different variation approaches will be described in detail below.

[0064] In a specific example, the variable step size changes linearly, which can be achieved by using an arithmetic progression. The specific expression for the variable step size is: step n =step1+(n-1)×d; where step n This represents the step size for the nth expansion, where step1 represents the initial step size and d represents the tolerance. The specific values ​​can be set according to the actual needs of those skilled in the art, for example, d=1 and step1=1.

[0065] In a specific example, the variable step size uses an exponential variation, and the expression for the variable step size is: step n =2 (n-1) In the formula, step n This represents the step size value of the nth expansion.

[0066] In a specific example, the variable step size adopts an adaptive change method. The adjustment rules for the variable step size are as follows: if the current write is successful and the previous write was also successful, the current step size value is increased to twice the value; if the current write fails, the current step size value is halved and rolled back to try again from the new position; if the current write is successful but the previous write failed, the current step size remains unchanged.

[0067] In a specific example, the variable step size adopts a segmented change method. The stage division process for adjusting the variable step size is as follows: the interval from the anchor point to the boundary of the detection interval is divided into the first sub-interval segment farthest from the boundary, the second sub-interval segment at a medium distance from the boundary, and the third sub-interval segment closest to the boundary; if the current search position is in the first sub-interval segment, the variable step size adopts an exponential change method to quickly approach the boundary; if the current search position is in the second sub-interval segment, the variable step size adopts a linear change method for conservative advancement; if the current search position is in the third sub-interval segment, the variable step size adopts a fixed small step size to accurately locate the boundary.

[0068] It should be noted that the four examples above can all meet the actual needs of this application, and those skilled in the art can choose the specific variation method of the variable step size according to actual needs. For ease of understanding, this embodiment will take the exponential variation method of the variable step size as an example to describe in detail the specific search process of the writable value range segment. Since the search process of the left and right boundaries of the writable value range segment is symmetrical, for the sake of simplification, the following will take the anchor point as the center and perform a boundary search to the right of the probe interval to locate the maximum writable value b of the writable value range segment as an example.

[0069] Specifically, such as Figure 5 As shown, initialize the current trial value cur=anchor and the step size step=1; loop through cur=cur+step, write the trial value cur and verify it.

[0070] If the verification passes, the anchor position is updated to anchor=cur, and the step size is multiplied exponentially, i.e. step=step×2, and the expansion continues until the current trial value cur is greater than or equal to the right boundary R of the current probe interval. Then, the current trial value cur is returned as the maximum writable value b of the writable value range.

[0071] If verification fails, i.e., a Modbus exception code is returned or a timeout occurs, the binary search phase begins. The specific process for the binary search phase is as follows: The last successfully written probe value, cur... last-success The probe value cur of the first failed write first-lose The formed interval [cur last-success +1, cur first-lose Perform a binary search within the interval -1]; each time, take the midpoint of the interval for writing. If the writing is successful, increment the midpoint of the left boundary of the interval by 1, otherwise decrement the midpoint of the right boundary of the interval by 1; until the left boundary of the interval is greater than the right boundary, take the right boundary of the interval as the maximum writable value b of the writable value range.

[0072] It should be noted that, based on the same method, by using the anchor point as the center and performing a boundary search to the left of the probe interval, the minimum writable value a of the writable value range can be located; by merging the minimum writable value a and the maximum writable value b found on the left and right sides, the required writable value range [a, b] can be obtained.

[0073] Understandably, this embodiment employs a hybrid search strategy of exponential step expansion and binary convergence. In large, unknown regions far from the boundary, it uses exponential steps to quickly traverse the area, resulting in a logarithmic rather than nonlinear increase in the number of communications. When approaching the boundary, it automatically switches to binary fine-tuning to ensure accurate boundary positioning. This strategy balances search speed and positioning accuracy, avoids the inefficiency of sequential traversal, and effectively reduces the number of register test messages.

[0074] In an embodiment, such as Figure 3 As shown, after successfully locating a writable range segment [a, b], the undetected portion of the current probe interval [L, R] needs to be enqueued for further processing. The specific process is as follows: based on the located writable range segment [a, b], the current probe interval [L, R] is enqueued based on a preset safety interval. The remaining intervals are [L, a- ] and [b+ [R]; if L≤a- The remaining interval [L, a- Stored at the rear of the exploration team; if b+ ≤R, the remaining interval [b+ , R] is stored at the tail of the detection team. Among them, for the safety interval The specific value can be selected by those skilled in the art based on their actual needs. In this embodiment, the safety interval... The preferred value is 2.

[0075] Understandably, based on the writable range [a, b], simply writing the remaining interval as [L, a] and [b, R] would lead to repeated probing of known writable boundary points; writing the remaining interval as [L, a-1] and [b+1, R] would retain the boundary neighbor points a-1 and b+1, which have been indirectly proven to be dead zones by the boundary search results, resulting in unnecessary invalid write commands. Therefore, in this embodiment, by setting a safety interval Δ=2, the integrity of the test is ensured by excluding known writable points and known dead points, while also employing a post-processing merging strategy.

[0076] It's important to understand that when all fourth-order probes fail, it's determined that there are no writable points within the current probe interval. However, this interval could be a wide interval containing extremely narrow writable intervals, such as an isolated single point; or it could be a truly unwritable dead zone. Directly marking all large intervals with no writable points as dead zones might miss hidden narrow writable intervals; infinitely splitting all large intervals would lead to excessive communication. Therefore, the proposed technical solution uses a preset interval width threshold to adopt differentiated processing strategies for large and small intervals; for ease of understanding, a detailed description follows.

[0077] In a specific embodiment, when performing step S400, as follows: Figure 3 As shown, if no anchor point is found within the current detection interval, the width of the current detection interval is compared with a preset interval width threshold. If the width of the current detection interval is less than or equal to the preset interval width threshold, it is marked as a dead interval and added to the global dead interval set; otherwise, the current detection interval is split in half and stored in the detection queue.

[0078] It should be understood that the specific value of the interval width threshold can be selected according to the actual needs of those skilled in the art, such as 40, 50, or 60; in this embodiment, the interval width threshold is preferably 50. The width W of the current detection interval is W = R - L + 1. If the width W of the current detection interval is ≤ 50, it is marked as a dead interval and added to the global dead interval set D. Any sub-intervals covered by this interval will be skipped directly in the pre-verification stage. If the width W of the current detection interval is > 50, the current detection interval is split in half and stored at the tail of the detection queue. If a narrow writable interval exists in a certain sub-interval, after splitting to a sufficiently fine granularity, the subsequent anchor point detection can successfully discover the writable point.

[0079] It is important to understand that during step S500, steps S200 to S400 are executed repeatedly to search all writable value range segments in the probe queue. To avoid infinite loops or resource waste, the loop needs to exit at an appropriate time. Existing solutions typically only use an empty probe queue as the termination condition. However, in some scenarios, such as when all value ranges have been covered by the dead zone but there are still remaining ranges in the queue, continuing processing will cause unnecessary communication waste; or, if a software exception causes the queue to never be empty, the algorithm will fall into an infinite loop. Therefore, the technical solution of this application provides multi-dimensional loop termination conditions, achieving intelligent exit and exception protection while ensuring the integrity of the test; for ease of understanding, a detailed description will be provided below.

[0080] In a specific embodiment, when executing step S500, the loop termination conditions include the probe queue being empty, the loop count reaching the preset maximum loop count, and the theoretical value range of the current register under test being completely covered by the global dead interval set; when any of the termination conditions are met, the loop exits.

[0081] Specifically, the loop termination condition of an empty probe queue means that there are no more intervals to be probed in the probe queue, the entire value range has been traversed or covered by dead intervals, which is a normal loop termination situation. The loop termination condition of reaching the preset maximum number of loops M serves as a protection mechanism against infinite loops caused by software anomalies or communication failures. The specific value of the maximum number of loops M can be set according to the actual needs of those skilled in the art, for example, it can be set to 1000, 1500, or 2000. For the loop termination condition where the theoretical value range of the currently tested register is completely covered by the global set of dead intervals, although there may still be remaining intervals in the probe queue, the algorithm can determine through logical judgment that these remaining intervals must all fall within the confirmed dead interval range, eliminating the need to waste communication resources on actual probing.

[0082] It is important to understand that after the loop ends, the writable range segments recorded in the valid interval list V may have the following problems: Due to the halving in step S400 and the introduction of the safety interval Δ in step S300, the originally continuous writable range may be split into multiple closely adjacent interval segments. Furthermore, due to communication interference in industrial settings, some intervals may result in false or misjudged results. Therefore, the technical solution of this application provides a post-processing workflow that ensures the accuracy, completeness, and readability of the output results through sorting, merging, secondary verification, and formatted output; for ease of understanding, a detailed description will follow.

[0083] In a specific embodiment, the process of outputting the test results during step S500 is as follows: All writable value ranges recorded in the valid interval list are sorted in ascending order according to their left boundary values. If the interval between two adjacent writable value ranges is less than or equal to a preset safety interval, they are merged to eliminate redundant segments caused by the safety interval in the aforementioned steps, and the writable ranges that can be considered continuous in engineering are reassembled into complete intervals. For each merged writable value range, its left endpoint, midpoint, and right endpoint are selected for write-readback verification to eliminate false intervals caused by transient communication interference. Successfully verified writable value ranges are confirmed and included in the final output; writable value ranges that fail verification retain their information but are marked as suspected intervals, pending manual review to determine whether to retain or remove them.

[0084] It is important to understand that after testing, the values ​​stored in the registers may have been altered by write operations during the testing process. If the system is not restored to its pre-test state, the equipment's operating parameters will be permanently tampered with, potentially leading to serious industrial safety accidents such as relay protection malfunctions and inverter parameter drift. Existing solutions lack a reliable automatic rollback mechanism. Therefore, the technical solution in this application provides a closed-loop recovery mechanism based on write operations, readback verification, and failure retries to ensure zero tampering with equipment parameters. For ease of understanding, a detailed description follows.

[0085] In a specific embodiment, when executing step S600, the specific process of restoring the tested register is as follows: For the tested register, the original backup value is written back and restored using the Modbus protocol's write function code. For a single register, Modbus protocol function code 06 can be used; for multiple registers, Modbus protocol function code 16 can be used. The write-back operation is verified using Modbus protocol function code 03 to determine if the restored value matches the original backup value. If the restored value matches the original backup value, the readback verification is successful, and the register restoration is complete. If the restored value does not match the original backup value, the readback verification fails, and the write-back and readback verification operations are repeated until the readback verification succeeds or a preset maximum number of repetitions is reached. The maximum number of repetitions can be set according to the actual needs of those skilled in the art, for example, it can be set to 3 times. If restoration still fails after repeating the write-back and readback verification operations 3 times, the restoration failure information is recorded in the log, and manual intervention is prompted.

[0086] In the technical solution of this application, in order to ensure that the register's response to each write instruction is not interfered with by external factors, a write-double readback verification mechanism can be performed on each write instruction of the register. That is, after each write instruction is issued to the register and the corresponding write operation is completed, two consecutive register readback operations are performed. Only when the two readback values ​​are consistent with the written value is the write operation deemed valid; otherwise, the write operation is re-executed.

[0087] Another aspect of this application provides a system for implementing the above-described adaptive test method for the writable range of Modbus slave registers, such as... Figure 6 As shown, one preferred embodiment includes a Modbus communication module, a dual read / write verification module, a queue and dead zone cache module, an anchor point detection module, a boundary retrieval module, a register state backup and recovery module, and an automatic test linkage module.

[0088] The Modbus communication module, located at the system's bottom layer, encapsulates the Modbus RTU protocol stack and is used to establish communication connections with externally tested registers, performing register read-back and write operations. Specifically, based on the master station's logic instructions, this module constructs application data units conforming to the protocol specifications: function code 03 (read holding register), function code 06 (write to a single register), and function code 16 (write to multiple registers); it automatically calculates and adds CRC-16 cyclic redundancy check codes; and it strictly adheres to the RTU frame delimitation rules, using a silence interval of at least 3.5 characters as frame start and end markers for data transmission and reception. Furthermore, this module manages the opening and closing of serial port resources, monitors their status, and implements a message timeout retransmission mechanism, providing transparent and reliable physical layer communication services to upper-layer modules.

[0089] The dual read-write verification module performs two consecutive register read-back operations after each write command is issued. The write operation is considered valid only if both read-back values ​​match the written value. Specifically, after each write command (function code 06 or 16) is successfully issued to the register under test, the module does not immediately determine a successful write. Instead, it automatically triggers two consecutive register read operations (function code 03), with a time interval of at least 3.5 character intervals between the two read operations. The dual read-write verification module then compares the two read values ​​with the original written value one by one. Only when both read-back values ​​are completely identical to the written value does it return a successful write flag to the main logic module. This design effectively distinguishes between genuine register value changes and false write confirmations caused by RS485 bus interference, slave transient response delays, etc., fundamentally ensuring the objectivity and authenticity of anchor point discovery and boundary detection results.

[0090] The queue and dead-interval caching module maintains the probe queue and the global dead-interval set. The probe queue stores the register value ranges to be probed, with each range represented as a tuple of left endpoint L and right endpoint R. The global dead-interval set stores value ranges that have been confirmed to be completely unwritable, preferably stored and managed using a red-black tree or interval tree data structure. This set records value ranges that have been fully verified and confirmed to be completely unwritable during the testing process. Specifically, the lifecycle of the queue and dead-interval caching module covers the entire process of a single test session, ensuring that any confirmed read-only dead-interval information can be directly referenced in subsequent interval splitting and probing processes, thereby avoiding repeated and invalid access to known dead zones.

[0091] The anchor point detection module retrieves the current detection interval from the detection queue and executes multiple detection strategies within that interval according to preset priorities to find writable values ​​as anchor points. If all detection strategies fail, a "no writable points" signal is generated. Specifically, the anchor point detection module sequentially executes four types of low-overhead test value write operations according to a preset, fixed priority order. Once any level of test value passes the verification by the dual read-write verification module, a valid anchor point is generated, and subsequent higher-order detections are immediately terminated. The anchor point value is then output to the boundary retrieval module. This hierarchical detection strategy fully considers the statistical distribution characteristics of register values ​​in industrial field devices, aiming to find writable points with the highest probability and minimal communication overhead.

[0092] The boundary retrieval module is used to search for writable value ranges and store them in the list of valid intervals when an anchor point is successfully found; and to merge the current probe interval into the global dead zone set or store it in the probe queue when a signal indicating no writable points is received. Specifically, the boundary retrieval module uses the anchor point as a reference and performs exponential step expansion write probes in both the left and right directions to quickly approximate the approximate range of the boundary; when an expansion write fails, it immediately switches to the second stage, performing a classic binary search within the narrow range between the last successful value and the first failed value to accurately locate the left boundary 'a' and the right boundary 'b' of the continuous writable segment; this hybrid strategy balances the speed of long-distance boundary search with the accuracy of short-distance positioning.

[0093] The register state backup and restore module stores the current value of the register under test as the original backup value at the start of the test, and writes the original backup value back to the corresponding register after the test is completed. Specifically, the module first reads the current value of the register using function code 03 and stores the key-value pair (register address, original value) in a backup cache table. After the entire test process is completed, the module iterates through the backup cache table, and for each entry, writes the original value back to the corresponding register one by one using function code 06 or 16. After each write-back, a read verification is performed using function code 03 to ensure successful restoration. This mechanism ensures that the operating parameters of the device under test can be completely restored to their pre-test state after the test, achieving "zero tampering" of the device under test.

[0094] The automated test linkage module controls the start and stop of the anchor point detection module, boundary retrieval module, and register backup and recovery module. After the test, it merges all consecutive writable value segments in the valid range list and outputs standardized test results. Specifically, the automated test linkage module includes a parser for a standard CSV format test configuration file, capable of batch importing parameters such as the address, data type, and theoretical value range of the registers under test, enabling automated and batch testing of multiple registers and addresses. After the test is completed, the module automatically summarizes information such as the valid range list, communication message statistics, and device status recovery logs, generating a structured Excel or TXT format test report. This report can be directly used for device factory testing or protocol conformance certification.

[0095] To facilitate understanding of the technical solution of this application, the specific implementation process of this application will be described in detail below through a specific parameter example.

[0096] I. Pre-test information.

[0097] The tested object is a certain model of inverter. Its Modbus holding register address is 43012, which is used to store the battery model code. The data type is U16, and the theoretical value range is [0, 65535]. The actual writable value distribution of this register is very special. It is not a single continuous interval, but four isolated discrete intervals, namely [256, 263], [513, 519], [769, 775], and an isolated single point [1000, 1000]. All other values ​​are read-only.

[0098] II. Initialization Phase.

[0099] The operator enters register address 43012 in the software interface and selects data type U16. The software automatically pushes the theoretical value range [0, 65535] into the probe queue as the first interval to be probed. Simultaneously, the software sends a read request to address 43012 via Modbus protocol function code 03. Assuming the original value returned by the slave device is 256 (i.e., hexadecimal 0x0100), the software stores the key-value pair (43012, 256) in the backup cache. The global dead interval set D is initialized to an empty set, and the valid interval list V is initialized to an empty list. Algorithm control parameters are loaded with preset values: safety interval Δ=2, interval width threshold T=50, maximum random sampling number K=3, maximum iteration number M=1000. At this point, the probe queue contains only one element, the interval [0, 65535].

[0100] III. Initial interval pre-verification and fourth-order detection of anchor points.

[0101] The algorithm enters the main loop and retrieves the unique probe interval [0, 65535] from the front of the probe queue. During the pre-verification phase, since the global dead interval set D is empty and the interval width W = 65535 - 0 + 1 = 65536 is much greater than 2, the interval successfully passes the pre-verification and enters the anchor point discovery phase.

[0102] In the first-order probe, the algorithm sequentially writes 0, 1, the theoretical minimum value of 0, and the theoretical maximum value of 65535 to the register. Assuming that writing 0 fails because the register returns a Modbus exception code for the write request to the value 0, the double read / write verification fails; writing 1 also fails, writing the theoretical minimum value of 0 fails, and writing 65535 also fails.

[0103] After all first-order probes fail, the algorithm proceeds to the second-order probe. The software retrieves the original value of the register, 256, from the backup cache and rewrites it to address 43012 using function code 06. Subsequently, the dual read-write verification module reads the register twice consecutively, returning 256 each time, perfectly matching the written value. The second-order probe is successful, generating a valid anchor point, anchor=256. The algorithm immediately terminates the anchor point discovery process for the current probe interval and enters the boundary search phase with the anchor point value 256.

[0104] IV. Boundary Search.

[0105] Using anchor=256 as the center, perform symmetrical boundary searches to the right (increasing direction of value) and to the left (decreasing direction of value).

[0106] First, perform a right boundary search. The algorithm initializes the current trial value cur = 256 and the step size step = 1. First expansion: cur = 256 + 1 = 257. Write 257 and double-verify. The register returns success, and the last successful trial value cur is recorded. last-success =257, step size doubled to step=2. Second expansion: cur=257+2=259, writing 259 successfully, cur last-success =259, step size doubled to step=4. Third expansion: cur=259+4=263, writing 263 successfully, cur last-success =263, the step size is doubled to step=8. Fourth expansion: cur=263+8=271, write 271 to the register, the register returns a Modbus exception code, the write fails, and the step size expansion stage ends.

[0107] At this point, the last successful trial value has been confirmed as 263, and the first failed trial value as 271. The algorithm initiates a binary search within the interval [264, 270] to precisely locate the right boundary b. The binary search process is as follows: Take the midpoint mid=floor((264+270) / 2)=267. Writing to 267 fails, indicating that the writable interval is on the left. Adjust the writable interval to [264, 266]; Take the midpoint mid=floor((264+266) / 2)=265. Writing to 265 fails. Adjust the writable interval to [264, 264]; Take the midpoint mid=floor((264+264) / 2)=264. Writing to 264 fails. When adjusting the writable interval at this point, its right boundary 263 is less than the left boundary 264, so the loop terminates. The right boundary 263 of the writable interval is taken as the right boundary b of the writable range segment.

[0108] The algorithm then performs a left boundary search, expanding leftwards in decreasing increments from anchor point 256. The first expansion: cur = 256 - 1 = 255. Writing to 255 fails, and the left boundary expansion phase terminates immediately with no successful values. A binary search is then performed within the interval [256, 254]. Since this interval is empty, the left boundary a = anchor = 256 is directly derived. At this point, the complete and continuous writable range [256, 263] is successfully defined, and the algorithm stores this interval in the valid interval list V.

[0109] V. Splitting and queuing the remaining intervals.

[0110] The current probe interval is [0, 65535], and the writable range segment already discovered is [256, 263]. The algorithm executes the splitting logic: the remaining interval on the left is [0, 254]. Since 0 ≤ 254 is true, [0, 254] is pushed to the tail of the probe queue. The remaining interval on the right is [265, 65535]. Since 265 ≤ 65535 is true, [265, 65535] is pushed to the tail of the probe queue. At this time, the two intervals waiting to be probed in the probe queue are: [0, 254] and [265, 65535].

[0111] VI. Multiple iterations.

[0112] The algorithm retrieves the probe interval [0, 254] from the front of the probe queue. If the pre-verification passes, it enters the anchor point discovery phase. Assuming all first-order probes fail, it proceeds to the second-order probe. The second-order probe reads the backup value 256 and attempts to write it, but note that the current probe interval is [0, 254], and 256 is not within this interval. Therefore, the second-order probe either does not execute within this interval or fails naturally after execution. The third-order probe takes the midpoint mid = floor((0+254) / 2) = 127, and writing 127 fails. The fourth-order probe randomly samples and generates three random numbers, assuming they are 89, 201, and 37, and writing them sequentially all fails. Since all four-order probes fail, it is determined that there are no valid anchor points within the current probe interval [0, 254].

[0113] The current detection interval [0, 254] is split and enqueued. The current interval width W = 254 - 0 + 1 = 255, which is greater than the threshold T = 50. Therefore, the algorithm does not directly mark the current detection interval [0, 254] as a dead zone, but instead splits it in half into two sub-intervals: [0, 127] and [128, 254], and pushes them to the tail of the detection queue. At this time, the intervals waiting to be detected in the detection queue are: [265, 65535], [0, 127], and [128, 254].

[0114] The algorithm processes the two probe intervals [0, 127] and [128, 254] sequentially. For the probe interval [0, 127], all fourth-order probes fail, and its interval width W = 128 > 50. It is then further split into [0, 63] and [64, 127] and enqueued. For the probe interval [128, 254], all fourth-order probes fail, and its interval width W = 127 > 50. It is then further split into [128, 191] and [192, 254] and enqueued. The algorithm continues to process the probe interval [0, 63], whose interval width W = 64 > 50. All fourth-order probes fail, and it is then split into [0, 31] and [32, 63] and enqueued. When processing the probe interval [32, 63], its interval width W = 32 ≤ 50, and all fourth-order probes fail. The algorithm determines that this probe interval is indeed a read-only dead zone and inserts the probe interval [32, 63] into the global dead interval set D. In subsequent probes, any sub-interval falling within the range [32, 63] is discarded during the pre-verification phase due to dead zone coverage checks, thus incurring no further communication overhead. Similarly, probe intervals [0, 31], [64, 95], [96, 127], [128, 159], [160, 191], [192, 223], and [224, 254] are marked as dead zones and incorporated into the global dead interval set D in subsequent iterations. Ultimately, the entire [0, 254] interval is completely covered by several dead interval records, and all corresponding sub-intervals in the probe queue are cleared.

[0115] The algorithm continues to retrieve the probe interval [265, 65535] from the probe queue. Pre-verification passes, entering the anchor point discovery phase. The first-order probe fails entirely. The second-order probe reads the backup value 256, but 256 is not within this interval, so it naturally fails. The third-order probe takes the midpoint mid=floor((265+65535) / 2)=32900, but writing to 32900 fails. The fourth-order probe randomly samples and generates three random numbers, assuming they are 502, 800, and 50000, all of which fail to write. With all fourth-order probes failing, the width W=65535-265+1=65271>50, so the interval is split in half into [265, 32899] and [32900, 65535] and enqueued. Through multiple iterations, the algorithm finds writable value ranges [513, 519], [769, 775], and [1000, 1000].

[0116] As the interval splitting causes the interval width to gradually shrink to below 50, each interval is marked as a dead zone and merged into the global dead interval set D. When these narrow intervals are inserted into the global dead interval set D, their parent intervals are determined to be completely covered by the dead zone during the pre-verification stage and are directly discarded, no longer generating any communication. Finally, the probe queue is empty, and the loop iteration terminates.

[0117] VII. Interval post-processing verification.

[0118] The algorithm performs post-processing on the list of valid intervals V={[256, 263], [513, 519], [769, 775], [1000, 1000]}. First, the intervals are sorted in ascending order by their left endpoints; the four intervals are naturally ordered and require no adjustment. Next, a merge check is performed: the intervals between adjacent intervals are 250 units between 263 and 513, 250 units between 519 and 769, and 225 units between 775 and 1000, all significantly greater than the safety interval Δ=2, therefore no merging is necessary. Then, a secondary verification is performed: for each interval, the left endpoint, midpoint, and right endpoint are taken and a write-double-read verification is performed again. For example, for the interval [256, 263], 256, 259, and 263 are written, all returning success; for the single-point interval [1000, 1000], 1000 is written, and the verification passes. After all passes, the algorithm concatenates the four intervals into a string format as "256-263; 513-519; 769-775; 1000-1000", writes it to the test log, and associates it with register address 43012.

[0119] 8. Safe restoration of equipment.

[0120] The algorithm iterates through the backup cache, retrieves the original value 256 from register 43012, and writes it back to that address using function code 06. Immediately after writing, a read operation is performed, returning 256, consistent with the backup value, indicating successful recovery. The software interface displays "Device restored to its pre-test state." Throughout the entire test, the register values ​​temporarily modified due to the test write were completely restored, and the device's operating parameters remained unchanged.

[0121] The basic principles, main features, and advantages of this application have been described above. Those skilled in the art should understand that this application is not limited to the above embodiments. The embodiments and descriptions in the specification are merely the principles of this application. Various changes and modifications can be made to this application without departing from its spirit and scope, and all such changes and modifications fall within the scope of the claims. The scope of protection claimed by this application is defined by the appended claims and their equivalents.

Claims

1. An adaptive testing method for the writable range of Modbus slave registers, characterized in that, Includes the following steps: The theoretical value range of the register to be tested is stored in the probe queue as the first probe interval, and its current read value is backed up. Select a probe interval from the probe queue that is not marked by the global dead interval set, and execute multiple probe strategies within the current probe interval to find writable values ​​as anchor points; If an anchor point is found, expand the search within the current detection interval with the anchor point as the center, locate the writable value range containing the anchor point and store it in the list of valid intervals, and at the same time store the remaining intervals of the current detection interval in the detection queue. If no anchor point is found, it is either merged into the global dead interval set or stored in the detection queue according to the width of the current detection interval. The process of selecting the probe interval and searching for the writable value range is executed repeatedly until the loop termination condition is met. When the loop terminates, the loop exits, and all writable value ranges recorded in the list of valid intervals are merged. The test results are then output to complete the test. Restore the registers that have completed the test to the current read values ​​from the backup.

2. The adaptive testing method for the writable range of Modbus slave registers as described in claim 1, characterized in that, When searching for anchor points within the current detection range, multiple detection strategies, including first-order detection, second-order detection, third-order detection, and fourth-order detection, are executed in sequence, and subsequent detection is terminated after any order of detection is successful. The first-order probe is configured to write the endpoint value of the theoretical value range of the register to be tested or a preset general characteristic value. The second-order probe is configured to read the original backup value of the register to be tested and immediately write it back to the register; The third-order probe is configured to calculate and write the midpoint value of the current probe interval; The fourth-order probe is configured to generate and write at least one random value within the current probe interval.

3. The adaptive testing method for the writable range of Modbus slave registers as described in claim 1, characterized in that, The specific process of expanding the search to the left and right sides of the current detection interval with the anchor point as the center to locate the writable value range is as follows: Starting from the anchor point, write trial values ​​sequentially to the left and right sides of the current detection range at preset step sizes until writing fails; To the right of the current probe interval, perform a binary search between the last successful write attempt value and the first failed write attempt value to locate the maximum writable value as the right boundary value of the writable value range. To the left of the current probe interval, perform a binary search between the last successful write attempt value and the first failed write attempt value to locate the minimum writable value as the left boundary value of the writable value range. The preset step size is a variable step size, which can be one of the following: linear change, exponential change, adaptive change, or piecewise change.

4. The adaptive testing method for the writable range of Modbus slave registers as described in claim 3, characterized in that, After locating the writable range [a, b], the current probe interval [L, R] is based on a preset safety interval. The remaining intervals are [L, a- ] and [b+ The specific process of storing the remaining interval segment into the probe queue is as follows: If L≤a- The remaining interval [L, a- Stored at the rear of the exploration team; If b+ ≤R, the remaining interval [b+ ,R] is stored at the tail of the exploration team.

5. The adaptive test method for the writable range of Modbus slave registers as described in any one of claims 1-4, characterized in that, If no anchor point is found, the width of the current detection interval is compared with the preset interval width threshold. If the width of the current detection interval is less than or equal to the preset interval width threshold, it is marked as a dead interval and added to the global dead interval set; otherwise, the current detection interval is split in half and stored in the detection queue.

6. The adaptive testing method for the writable range of Modbus slave registers as described in claim 1, characterized in that, The loop termination conditions include an empty probe queue, the number of loops reaching the preset maximum number of loops, and the theoretical value range of the current register under test being completely covered by the global dead interval set; the loop exits when any of the termination conditions are met.

7. The adaptive testing method for the writable range of Modbus slave registers as described in claim 1, characterized in that, The specific process for outputting the test results is as follows: Sort all writable value ranges recorded in the list of valid intervals in ascending order according to their left boundary values; If the interval between two adjacent writable value ranges is less than or equal to the preset safety interval, the two will be merged. For each writable value segment after merging, perform write-readback verification at its left endpoint, midpoint, and right endpoint respectively; Writable ranges that pass verification are confirmed and included in the final output. Writable ranges that fail verification are retained but marked as suspected ranges, and will be retained or removed after manual review.

8. The adaptive testing method for the writable range of Modbus slave registers as described in claim 1, characterized in that, The specific process for restoring the registers after the test is completed is as follows: For the registers that have completed the test, the original backup values ​​are written back and restored using the write function code of the Modbus protocol; Perform a readback verification on the write-back operation to determine whether the restored value is consistent with the original backup value; If the restored value matches the original backup value, the readback verification is considered successful, and the register restoration is complete. If the restored value is inconsistent with the original backup value, the readback verification is deemed to have failed. The write-back and readback verification operations are repeated until the readback verification is successful or the preset limit for the number of repetitions is reached.

9. The adaptive testing method for the writable range of Modbus slave registers as described in claim 1, characterized in that, After each write operation is completed according to the issued write instruction, two register read-back operations are performed consecutively. The write operation is considered valid only if the two read-back values ​​are consistent with the write value.

10. A system for implementing an adaptive test method for the writable range of Modbus slave registers as described in any one of claims 1-8, characterized in that, include: The Modbus communication module, located at the system's bottom layer, encapsulates the Modbus RTU protocol stack and is used to establish communication connections with external registers under test, and to perform register read-back and write operations. The dual read-write verification module is used to perform two consecutive register read-back operations after each write command is issued. The write operation is considered valid only if the two read-back values ​​are consistent with the write value. The queue and dead interval cache module is used to maintain the probe queue and the global dead interval set. The probe queue is used to store the register value range to be probed, and the global dead interval set is used to store the value range segment that has been confirmed to be completely unwritable. An anchor point detection module is used to retrieve the current detection interval from the detection queue, execute multiple detection strategies according to preset priorities to find writable values ​​as anchor points, and generate a no-writable-point signal when all detection strategies fail. The boundary retrieval module is used to search for writable value ranges and store them in the list of valid intervals when an anchor point is successfully discovered; and to merge the current detection interval into the global dead zone set or store it in the detection queue when a signal of no writable points is received. The register state backup and recovery module is used to store the current value of the register under test as the original backup value at the start of the test, and to write the original backup value back to the corresponding register after the test is completed. An automatic test linkage module is used to control the start and stop of the anchor point detection module, the boundary retrieval module, and the register backup and recovery module. After the test is completed, it merges all consecutive writable value ranges in the effective interval list and outputs standardized test results.

Images