Modbus is a serial communications protocol published by Modicon in 1979 for use with its programmable logic controllers (PLCs). Simple and robust, it has since become one of the de facto standard communications protocols in the industry, and it is now amongst the most commonly available means of connecting industrial electronic devices.[1] The main reasons for the extensive use of Modbus in the industrial environment are:
Modbus allows for communication between many (approximately 240) devices connected to the same network, for example a system that measures temperature and humidity and communicates the results to a computer. Modbus is often used to connect a supervisory computer with a remote terminal unit (RTU) in supervisory control and data acquisition (SCADA) systems. Many of the data types are named from its use in driving relays: a single-bit physical output is called a coil, and a single-bit physical input is called a discrete input or a contact.
The development and update of Modbus protocols are managed by the Modbus Organization, formed of independent users and suppliers of Modbus compliant devices.
Contents |
Versions of the Modbus protocol exist for serial port and for Ethernet and other networks that support the Internet protocol suite. Most Modbus devices communicate over a serial EIA-485 physical layer [1]. There are many variants of Modbus protocols
Data model and function calls are identical for the first 4 variants of protocols; only the encapsulation is different. However the variants are not interoperable as the frame formats are different.
Each device intended to communicate using Modbus is given a unique address. In serial and MB+ networks only the node assigned as the Master may initiate a command, but on Ethernet, any device can send out a Modbus command, although usually only one master device does so. A Modbus command contains the Modbus address of the device it is intended for. Only the intended device will act on the command, even though other devices might receive it (an exception is specific broadcastable commands sent to node 0 which are acted on but not acknowledged). All Modbus commands contain checking information, ensuring that a command arrives undamaged. The basic Modbus commands can instruct an RTU to change a value in one of its registers, control or read an I/O port, as well as commanding the device to send back one or more values contained in its registers.
There are many modems and gateways that support Modbus, as it is a very simple protocol and often copied. Some of them were specifically designed for this protocol. Different implementations use wireline, wireless communication, such as in the ISM band, and even SMS or GPRS. One of the more common designs of wireless networks makes use of the mesh topology. Typical problems the designers have to overcome include high latency and timing problems.
All modbus variants choose different frame formats.[1]
| Modbus RTU Frame Format | ||||
|---|---|---|---|---|
| Name | Length | Function | ||
| Start | 3.5c idle | at least 3-1/2 character times of silence (MARK condition) | ||
| Address | 8 bits | Station Address | ||
| Function | 8 bits | Indicates the function codes like read coils / inputs | ||
| Data | n * 8 bits | Data + length will be filled depending on the message type | ||
| CRC | 16 bits | Error checks | ||
| End | 3.5c idle | at least 3-1/2 character times of silence between frames | ||
| Modbus ASCII Frame Format | ||||
|---|---|---|---|---|
| Name | Length | Function | ||
| Start | 1 char | starts with colon ( : ) (ASCII value is 3A hex) | ||
| Address | 2 chars | Station Address | ||
| Function | 2 chars | Indicates the function codes like read coils / inputs | ||
| Data | n chars | Data +length will be filled depending on the message type | ||
| LRC | 2 chars | Error checks | ||
| End | 2 chars | carriage return – line feed(CRLF) pair (ASCII values of 0D & 0A hex) | ||
| Modbus TCP Frame Format | ||||
|---|---|---|---|---|
| Name | Length | Function | ||
| Transaction Identifier | 2 bytes | For synchronization between messages of server
& client |
||
| Protocol Identifier | 2 bytes | Zero for MODBUS/TCP | ||
| Length Field | 2 bytes | Number of remaining bytes in this frame | ||
| Unit Identifier | 1 byte | Slave Address (255 if not used) | ||
| Function code | 1 byte | Function codes as in other variants | ||
| Data bytes | n bytes | Data as response or commands | ||
Unit identifier is used with MODBUS/TCP devices that are composites of several MODBUS devices, e.g. on MODBUS/TCP to MODBUS RTU gateways. In such case, the unit identifier tells the Slave Address of the device behind the gateway. Natively MODBUS/TCP-capable devices usually ignore the Unit Identifier.
The byte order is Big-Endian (first byte contains MSB)
Note: The "Function code" field is part of the PDU and not part of the transport (TCP) header.
The various reading, writing and other operations are categorised as follows.[4] The most primitive reads and writes are shown in bold. A number of sources [5] use alternative terminology, for example Force Single Coil where the standard uses Write Single Coil.
| Function Name | Function Code | |||
|---|---|---|---|---|
| Data Access | Bit access | Physical Discrete Inputs | Read Discrete Inputs | 2 |
| Internal Bits or Physical Coils | Read Coils | 1 | ||
| Write Single Coil | 5 | |||
| Write Multiple Coils | 15 | |||
| 16-bit access | Physical Input Registers | Read Input Register | 4 | |
| Internal Registers or Physical Output Registers | Read Holding Registers | 3 | ||
| Write Single Register | 6 | |||
| Write Multiple Registers | 16 | |||
| Read/Write Multiple Registers | 23 | |||
| Mask Write Register | 22 | |||
| Read FIFO Queue | 24 | |||
| File Record Access | Read File Record | 20 | ||
| Write File Record | 21 | |||
| Diagnostics | Read Exception Status | 7 | ||
| Diagnostic | 8 | |||
| Get Com Event Counter | 11 | |||
| Get Com Event Log | 12 | |||
| Report Slave ID | 17 | |||
| Read Device Identification | 43 | |||
| Other | Encapsulated Interface Transport | 43 | ||
Almost all implementations have variations from the official standard. Different varieties might not communicate correctly between equipment of different suppliers. Some of the most common variations are:
The Modbus organization is a trade association for the promotion and development of Modbus protocol.
|
|||||||||||||||||||||||