Modbus Protocol

1. MODBUS AND PROFIBUS
PA/DP/FMS AND FF
Unit IV
MODBUS AND PROFIBUS PA/DP/FMS AND FF

2. MODBUS
• The Modbus communication protocol is the oldest and by
far the most popular automation protocol in the field of
process automation and SCADA (Supervisory Control and
Data Acquisition).
• Modbus is a communications protocol published
by Modicon in 1979 for use with its Programmable Logic
Controllers (PLCs). Modicon is now owned by Schneider
Electric.
• Modbus provides a common language for devices and
equipment to communicate with one and another.
• For example, Modbus enables devices on a system that
measures temperature and humidity connected on the
same network to communicate the results to a supervisory
computer or PLC.
• The device requesting the information is called the Modbus
Client and the devices supplying information are Modbus
Servers. In a standard Modbus network, there is one Client
and up to 247 Servers, each with a unique Server Address
from 1 to 247. The Client can also write information to the
Servers.

3. Types of MODBUS Communication
• MODBUS ASCII
• MODBUS ASCII/RTU is a master-slave communication protocol, able to support up to 247 slaves
connected in a bus or a star network. The protocol uses a simplex connection on a single line. In this
way, the communication messages move on a single line in two opposite directions.
• MODBUS RTU
• Modbus-RTU (Remote Terminal Unit) means that the Modbus protocol is used on top of a serial line
with an RS-232, RS-485 or similar physical interface. Numerous automation systems have Modbus-RTU
interfaces for communication.
• MODBUS TCP/IP
• Modbus TCP/IP (also Modbus-TCP) is simply the Modbus RTU protocol with a TCP interface that runs on
Ethernet. The Modbus messaging structure is the application protocol that defines the rules for
organizing and interpreting the data independent of the data transmission medium.
• MODBUS PLUS
• Modbus Plus, is a high speed peer to peer network protocol based on token passing communication.
Modbus Plus nodes on a the network access the network upon receipt of a token frame.

4. MODBUS PROTOCOL
• MODBUS© Protocol is a messaging structure, widely used to establish master-slave communication between
intelligent devices. A MODBUS message sent from a master to a slave contains the address of the slave, the
'command' (e.g. 'read register' or 'write register'), the data, and a check sum (LRC or CRC).
Since Modbus protocol is just a messaging structure, it is independent of the underlying physical layer. It is
traditionally implemented using RS232, RS422, or RS485
• The Request
The function code in the request tells the addressed slave device what kind of action to perform. The data
bytes contains any additional information that the slave will need to perform the function. For example,
function code 03 will request the slave to read holding registers and respond with their contents. The data
field must contain the information telling the slave which register to start at and how many registers to read.
The error check field provides a method for the slave to validate the integrity of the message contents.
• The Response
If the slave makes a normal response, the function code in the response is an echo of the function code in
the request. The data bytes contain the data collected by the slave, such as register values or status. If an
error occurs, the function code is modified to indicate that the response is an error response, and the data
bytes contain a code that describes the error. The error check field allows the master to confirm that the
message contents are valid.

5. MODBUS ASCII
• ASCII Mode
When controllers are setup to communicate on a Modbus network using ASCII
(American Standard Code for Information Interchange) mode, each eight-bit byte
in a message is sent as two ASCII characters. The main advantage of this mode is
that it allows time intervals of up to one second to occur between characters
without causing an error.
• Coding System
Hexadecimal ASCII printable characters 0 ... 9, A ... F
Bits per Byte
1 start bit
7 data bits, least significant bit sent first
1 bit for even / odd parity-no bit for no parity
1 stop bit if parity is used-2 bits if no parity
Error Checking
Longitudinal Redundancy Check (LRC)

6. • RTU Mode
When controllers are setup to communicate on a Modbus network using RTU
(Remote Terminal Unit) mode, each eight-bit byte in a message contains two
four-bit hexadecimal characters. The main advantage of this mode is that its
greater character density allows better data throughput than ASCII for the same
baud rate. Each message must be transmitted in a continuous stream.
• Coding System
Eight-bit binary, hexadecimal 0 ... 9, A ... F
Two hexadecimal characters contained in each eight-bit field of the message
Bits per Byte
1 start bit
8 data bits, least significant bit sent first
1 bit for even / odd parity-no bit for no parity
1 stop bit if parity is used-2 bits if no parity
Error Check Field
Cyclical Redundancy Check (CRC)

8. • The Function Code field tells the addressed slave what function to perform.
The following functions are supported by Modbus poll
• 01 (0x01) Read Coils
02 (0x02) Read Discrete Inputs
03 (0x03) Read Holding Registers
04 (0x04) Read Input Registers
05 (0x05) Write Single Coil
06 (0x06) Write Single Register
08 (0x08) Diagnostics (Serial Line only)
11 (0x0B) Get Comm Event Counter (Serial Line only)
15 (0x0F) Write Multiple Coils
16 (0x10) Write Multiple Registers
17 (0x11) Report Server ID (Serial Line only)
22 (0x16) Mask Write Register
23 (0x17) Read/Write Multiple Registers
43 / 14 (0x2B / 0x0E) Read Device Identification
• The data field contains the requested or send data.

9. • Function 01 (01hex) Read Coils
• Reads the ON/OFF status of
discrete coils in the slave.
• Request
The request message
specifies the starting coil and
quantity of coils to be read.
• Example of a request to read 13
coils address 10...22 (Coil 11 to 23)
from slave device address 4:
Field Name RTU (hex) ASCII Characters
Header None : (Colon)
Slave Address 04 0 4
Function 01 0 1
Starting Address Hi 00 0 0
Starting Address Lo 0A 0 A
Quantity of Coils Hi 00 0 0
Quantity of Coils Lo 0D 0 D
Error Check Lo DD LRC (E 4)
Error Check Hi 98
Trailer None CR LF
Total Bytes 8 17

10. • Response
The coil status response message is
packed as one coil per bit of the data
field. Status is indicated as: 1 is the
value ON, and 0 is the value OFF. The
LSB of the first data byte contains the
coil addressed in the request. The other
coils follow toward the high-order end
of this byte and from low order to high
order in subsequent bytes. If the
returned coil quantity is not a multiple
of eight, the remaining bits in the final
data byte will be padded with zeroes
(toward the high-order end of the byte).
The byte count field specifies the
quantity of complete bytes of data.
Field Name RTU (hex) ASCII Characters
Header None : (Colon)
Slave Address 04 0 4
Function 01 0 1
Byte Count 02 0 2
Data (Coils
18...11)
0A 0 A
Data (Coils
23...19)
11 1 1
Error Check Lo B3 LRC (D E)
Error Check Hi 50 None
Trailer None CR LF
Total Bytes 7 15

11. • Modbus Protocol (modbustools.com)