Modbus is a data communications protocol originally published by Modicon (now Schneider Electric) in 1979 for use with its programmable logic controllers (PLCs). Modbus has become a de facto standard communication protocol and is now a commonly available means of connecting industrial electronic devices. inSis DSI - Data Source Integration Service, provide extensive support for Modbus Protocol. This document helps to understand the Modbus Protocol and how to use it in inSis Suite for effectively read and write to devices that support Modbus.

1. Sophistication with Simplicity
Overview of inSis DSI
Modbus Interfaces

2. Agenda
1. Overview of Modbus
1. ModbusTCP & MobusRTU
2. Address Space
3. Function Blocks
4. Data Types
2. Modbus Gateway Configuration
3. Test Gateway
4. ValueSourceName configuration using Mapping Details
5. Scaling & Data Conversions
6. Demo

3. What is
Modbus
1. The industry’s serial de facto standard since 1979, MODBUS
continues to enable millions of automation devices to communicate.
2. MODBUS is an application layer messaging protocol. It is positioned
at level 7 of the OSI model
3. It provides client/server communication between devices connected
on different types of buses or networks like RS484, TCP/IP etc.
4. MODBUS is a request/reply protocol and offers services specified by
function codes.
5. One device must initiate a request and then wait for a response—
and the initiating device (the master) is responsible for initiating
every interaction
6. inSis DSI is Modbus Master. Converters, PLCs, Analyzers are slaves

4. How
it Works
1. Modbus is transmitted over serial lines between devices. The
simplest setup would be a single serial cable connecting the serial
ports on two devices, a Master and a Slave.
2. The data is sent as series of ones and zeroes called bits. Each bit is
sent as a voltage.
3. Zeroes are sent as positive voltages and a ones as negative.
4. The bits are sent very quickly. A typical transmission speed is 9600
baud (bits per second).

5. Modbus
1. Modbus RTU
1. Over RS485 Medium – 2 wire copper cable 0.2 sq mm (RJ11,
RJ45, DB9, Open)
2. Communication Params:
1. Baud Rate - 9600
2. Parity - None
3. Stop Bits = 1
4. Word Length - 8
5. Port Name
2. Modbus TCP
1. Modbus RTU over TCP IP/Ethernet – UTP Cable (RJ45)
2. Communication Params:
1. IP Address: 127.0.0.1
2. Port Number - 502
3. Both are serial communication

6. Modbus
Energy Meter
SlaveID#1
Energy Meter
SlaveID#2
PLC
SlaveID#3
Analyzer
SlaveID#4
RS485
Open
RS485
RJ11
RS485
RJ45
Ethernet
RJ45
inSis Server
(Server/Workstation)
Ethernet
Switch/Router
RS485 to Ethernet
Modbus RS485
Network
COM
RS485 to USB
Virtual
COM Port
5V Network
Baud Rate - 9600
Parity - None
Stop Bits = 1
Word Length - 8
192.168.1.10
502
192.168.1.11
502

7. Modbus
Slave Response Time Out:
Modbus is poll based. Once a command issues, it
will wait till the response is received. If the
response is not received in 500 millisecond, it will
ignore that query and issue new query.
Delay Between Polls:
If the response is received, it will wait for 250
millisecond and send next query
ConnectionType: In case of Modbus TCP select
Remote TCP Server. Provide the IP address of the
Modbus device and port number which is
obtained from Modbus Device

8. Modbus
Maximum Items/Query:
inSis DSI merges the addresses of multiple tags
and perform one query to optimize the
communication and delays. This settings define
maximum number of addresses to be read in one
single query.
inSis DSI automatically split the queries if the
address spaces are sparse.
TransmissionMode shall always be RTU

9. Modbus
Data Model
Modbus Address Space
1. There are only two data types in Modbus: coils and registers.
2. Coils are simply single bits. The bits can be ON (1) or they can be OFF (0).
3. Registers are simply 16-bit unsigned register data. Registers can have a value
from 0 to 65535 (0 to FFFF hexadecimal).
4. There is no representation for negative values, no representation for values
greater than 65535, and no representation for real data like 200.125.

10. Modbus
Data Model
Modbus Address Space
Object type Access Size Address Space
Function Code Read
(in Value Source Name)
Coil Read-write 1 bit 00001 - 09999 1
Discrete input Read-only 1 bit 10001 - 19999 2
Input register Read-only 16 bits 30001 - 39999 4
Holding register Read-write 16 bits 40001 - 49999 3
0 1 2 3 4 5 6 7 8 9
40,001 Reg1 Reg2 Reg3 Reg4 Reg5 Reg6 Reg7 Reg8 Reg9 Reg10
40,011 Reg11 Reg12 Reg13 Reg14 Reg15 Reg16 Reg17 Reg18 Reg19 Reg20
40,021 Reg21 Reg22 Reg23 Reg24 Reg25 Reg26 Reg27 Reg28 Reg29 Reg30
40,031 Reg31 Reg32 Reg33 Reg34 Reg35 Reg36 Reg37 Reg38 Reg39 Reg40
40,041 Reg41 Reg42 Reg43 Reg44 Reg45 Reg46 Reg47 Reg48 Reg49 Reg50
40,051 Reg51 Reg52 Reg53 Reg54 Reg55 Reg56 Reg57 Reg58 Reg59 Reg60
40,061 Reg61 Reg62 Reg63 Reg64 Reg65 Reg66 Reg67 Reg68 Reg69 Reg70
40,071 Reg71 Reg72 Reg73 Reg74 Reg75 Reg76 Reg77 Reg78 Reg79 Reg80
40,081 Reg81 Reg82 Reg83 Reg84 Reg85 Reg86 Reg87 Reg88 Reg89 Reg90
40,091 Reg91 Reg92 Reg93 Reg94 Reg95 Reg96 Reg97 Reg98 Reg99 Reg100

11. Modbus
Function
Blocks
Modbus Functions & Commands
1. Functions and Commands are used to read and write data
between Master and Slave
2. Each slave in a network is assigned a unique unit address from 1
to 247. When the master requests data, the first byte it sends is
the Slave address. This way each slave knows after the first byte
whether or not to ignore the message.
3. The second byte sent by the Master is the Function code. This
number tells the slave which table to access and whether to read
from or write to the table.
4. CRC stands for Cyclic Redundancy check. It is two bytes added to
the end of every modbus message for error detection.

12. Modbus
Function
Blocks
Modbus Function Blocks
Function name
Function
code
Comment
Bit access
Read Discrete Inputs 2
Read Coils 1
Write Single Coil 5
Write Multiple Coils 15
16-bit access
Read Input Registers 4
Read Multiple Holding Registers 3
Write Single Holding Register 6
Write Multiple Holding Registers 16
Read/Write Multiple Registers 23
Mask Write Register 22
Read FIFO Queue 24

13. Modbus
Data Types
Data Formats in Modbus
IO Data Type No of Bits Data Range
Number of Modbus
Registers/Coils
Int16 Signed 16 Bit -32768 and 32767 1 Register
Int Signed 32 Bit -2,147,483,648 and
2,147,483,647
2 Registers
Int64 Signed 64 Bit -- 4 Registers
UInt16 Unsigned 16 Bit 0 and 65535 1 Register
UInt Unsigned 32 Bit 0 and 4,294,967,295 2 Registers
Unit64 Unsigned 64 Bit -- 4 Registers
Float 32 Bit -3.4E+38 to +3.4E+38 2 Registers
Double 64 Bit -1.7E+308 to +1.7E+308 4 Registers
Bit 1 Bit 1 Coil
String Custom -- N Registers

14. Modbus
Data Types
0 1 2 3 4 5 6 7 8 9
40,001 Reg1 Reg2 Reg3 Reg4 Reg5 Reg6 Reg7 Reg8 Reg9 Reg10
40,011 Reg11 Reg12 Reg13 Reg14 Reg15 Reg16 Reg17 Reg18 Reg19 Reg20
40,021 Reg21 Reg22 Reg23 Reg24 Reg25 Reg26 Reg27 Reg28 Reg29 Reg30
40,031 Reg31 Reg32 Reg33 Reg34 Reg35 Reg36 Reg37 Reg38 Reg39 Reg40
40,041 Reg41 Reg42 Reg43 Reg44 Reg45 Reg46 Reg47 Reg48 Reg49 Reg50
Unsigned Integer Value = 50,000
Signed Integer Value = 25,000
One Register
Two Registers
Unsigned Integer 32 Bit, Value = 50,000
Signed Integer 32 Bit, Value = 25,000
Two Registers
Float 32 Bit, Value = 50,000
One Register
Signed Integer Value = 25,000

15. Modbus
Data Types 0101010101010101 Unit16 - 21845
01010101 01010101 00010001 00010001 Unit32 - 1431638289
01010101 01010101
00010001 00010001 Unit32 - 286348629
01001110 10101010 10101010 00100010 Float - 1431638289
01001101 10001000 10001010 10101011 Float - 286348629
Reg-1 Reg-2
Reg-2 Reg-1
21845 4369

16. Modbus
Address
in inSis
Modbus Address notation in inSis
1. DeviceID: Modbus Slave ID. It is set on the slave device
2. FunctionCode: To Read/Write from respective address spaces
3. StartAddress: From which the registers are to be read for the given data
4. NumberOfRegisters: Total number of Registers to read
5. Left/Right – To rearrage the registers before converting binary to decimal
1-3-10-2
DeviceID – FunctionCode – StartAddress – NumberofRegisters - Left/Right
1-3-10-2-1

17. Modbus
Address
in inSis
Examples for Modbus addresses in inSis
Param Address
Start
Register
Data Type
Value Source
Name
IO Data Type
Voltage
Holding
Registers
1
Unsigned Integer
32-bit
1-3-0-2 Uint/Unit32
Frequency
Holding
Registers
211
Unsigned Integer
16-bit
1-3-210-1 Uint16
Active
Power
Holding
Registers
401
Signed Integer
32-bit
1-3-400-2 Int/Int32
Power
Factor
Holding
Registers
501
Signed Integer
16-bit
1-3-500-1 Int16
Active
Energy
Holding
Registers
611 32-bit Float 1-3-610-2 Float
Feed Flow
Input
Registers
201 64-bit Double 1-4-200-4 Double
Pump
ON/OFF
Coils 101 Bit 1-1-100-1 Bit

18. Modbus
Address
in inSis
Examples for Modbus addresses in inSis
Param Address
Start
Register
Data Type
Value Source
Name
IO Data Type
Param1
Holding
Registers
5
Unsigned Integer
32-bit
1-3-4-2 Uint
Param2
Holding
Registers
200
Unsigned Integer
16-bit
1-3-199-1 UInt16
Param3
Holding
Registers
301
Signed Integer
32-bit
1-3-300-2 Int
Param4
Holding
Registers
51
Signed Integer
16-bit
1-3-50-1 Int16
Param5
Holding
Registers
60 32-bit Float 1-3-59-2 Float
Param6
Input
Registers
20 64-bit Double 1-4-19-4 Double
Param7 Coils 301 Bit 1-1-300-1 Bit

19. Modbus
Error Codes
Code Text Details
1 Illegal Function Function code received in the query is not recognized or allowed by slave
2 Illegal Data Address
Data address of some or all the required entities are not allowed or do not
exist in slave
3 Illegal Data Value Value is not accepted by slave
4 Slave Device Failure
Unrecoverable error occurred while slave was attempting to perform
requested action
5 Acknowledge
Slave has accepted request and is processing it, but a long duration of time
is required. This response is returned to prevent a timeout error from
occurring in the master. Master can next issue a Poll Program
Complete message to determine whether processing is completed
6 Slave Device Busy
Slave is engaged in processing a long-duration command. Master should
retry later
7 Negative Acknowledge
Slave cannot perform the programming functions. Master should request
diagnostic or error information from slave
8 Memory Parity Error
Slave detected a parity error in memory. Master can retry the request, but
service may be required on the slave device
10
Gateway Path
Unavailable
Specialized for Modbus gateways. Indicates a misconfigured gateway
11
Gateway Target Device
Failed to Respond
Specialized for Modbus gateways. Sent when slave fails to respond

20. Q & A