Modbus

training
Industrial
Automation Custumer
View Services

Slide 1 / 20

Modbus
Part 1 :

Reference documents - WEB sites

Part 2 :

Definitions

Part 3 :

Modbus frame description

Part 4 :

Security of transmission

Part 5 :
Industrial
Automation - Part 6 :
Custumer
View Services

Physical layer
Main characteristics resume
Slide 2 / 20

Part 1 : Reference documents - WEB sites

Schneider documents
Modbus User guide
Reference :

TSX DG MOD *

Detailed description of the Modbus protocol.

X-WAY communication user guide

Reference :

TSX DR NET *

This guide gives common characteristics to X-WAY Schneider networks.

Communication application specific functions PL7 Micro/Junior/Pro

Reference :

TLX DS COM PL7 42 *

Volume 1 : Common communication application

Volume 2 : Modbus bus

Industrial
Automation Custumer
View Services

Slide 3 / 20

Part 1 : Reference documents - WEB sites

WEB sites

Modbus.org :
http://www.modbus.org
Modicon site for Modbus users.

Transparent Factory :
http://www.transparentfactory.com
Schneider Electric site for Transparent Factory users.

Modbus Plus :
http://www.modicon.com/techpubs/toc6.html
Modbus Plus Planning and installation.
Industrial
Automation Custumer
View Services

Slide 4 / 20

Part 2 : Dfinitions

Modbus protocol

MODBUS Protocol is a messaging structure created by MODICON

company to connect PLC to programming tools.
It is now widely used to establish master-slave communication between
intelligent devices.
MODBUS is independent of the physical layer.
It can be implemented using RS232, RS422, or RS485 or over a variety
of media (e.g. fiber, radio, cellular, etc...).

Industrial
Automation Custumer
View Services

Slide 5 / 20

Part 2 : Dfinitions

Modbus Plus
MODBUS PLUS is a higher speed network 1 Mbit/s token passing derivative
that uses the MODBUS messaging structure.
7 Application
6 Presentation
5

Session

Transport

Network

Industrial
Automation1 Custumer
View Services

Link
Physical

Modbus

802.4 Token passing

RS485
Slide 6 / 20

Part 2 : Dfinitions

Modbus TCP/IP
MODBUS TCP/IP uses TCP/IP and Ethernet 10 Mbit/s or 100
Mbits/s to carry the MODBUS messaging structure.
7 Application
6 Preentation

Modbus

Session

Transport

TCP

Network

IP

Industrial
Automation1 Custumer
View Services

Link
Physical

CSMA / CD
ETHERNET V2 ou 802.3

Slide 7 / 20

Part 2 : Dfinitions

Modbus ASCII and Modbus RTU

The MODBUS protocol comes in 2 versions :
ASCII transmission mode
Each eight-bit byte in a message is sent as 2 ASCII characters.
RTU transmission mode
Each eight-bit byte in a message is sent as two four-bit hexadecimal
characters.
The main advantage of the RTU mode is that it achieves higher throughput.
ASCII mode allows time intervals of up to 1 second to occur between
Industrial
characters without causing an error.
Automation Custumer
View Services

Slide 8 / 20

Part 3 : Modbus frame description

Modbus frame structure

The Modbus frame structure is the same for requests (master to slave
messages) and responses (slave to master messages).
Modbus RTU
silence

Address

Function

Data

Checksum

silence

Silence >= 3,5 characters

Modbus ASCII

Industrial
:
Address
Automation Custumer
3A- Hex
View
Services

Function

Data

Checksum

CR

LF

0D Hex 0A Hex
Slide 9 / 20

Part 3 : Modbus frame description

Address field
Address

Function

Data

Checksum

Valid slave device addresses are in the range of 0 ... 247 decimal.
The individual slave devices are assigned addresses in the range of 1 ... 247.
Value 0 is reserved for broadcast messages (no response).
Request :
A master addresses a slave by placing the slave address in the address field of
the message.
Response :
Industrial
When the slave sends its response, it places its own address in this address field
Automation
- to let the master know which slave is responding.
of the response
Custumer
View Services

Slide 10 / 20

Part 3 : Modbus frame description

Function field
Address

Function

Data

Checksum

Valid codes are in the range of 1 ... 255 decimal.

Request :

The function code field tells the slave what kind of action to perform.
Response :

For a normal response, the slave simply echoes the original function code.

Industrial
Automation
For an exception
response, the slave returns a code that is equivalent to
Custumer
the original function code with its most significant bit set to a logic 1.
View Services

Slide 11 / 20

Part 3 : Modbus frame description

Data field
Address

Function

Data

Checksum

Valid codes are in the range of 0 ... 255 decimal.

Request :

The data field contains additional information which the slave must use to take
the action defined by the function code. This can include items like register
addresses, quantity of items to be handled, etc...
Response :

If no error occurs, the data field contains the data requested.

Industrial
Automation
If an error occurs,
the field contains an exception code that the master
Custumer
application can use to determine the next action to be taken.
View Services

Slide 12 / 20

Part 3 : Modbus frame description

Checksum field
Address

Function

Data

Checksum

Valid codes are in the range of 0 ... 255 decimal.

Modbus RTU uses CRC :
Modbus ASCII uses LRC :

Cyclycal Reduncy Check (2 byte)

Longitudinal Redundancy Check (1 bytes)

Request :

The checksum is calculated by the master and sends to the slave.

Response :

Industrial
The checksum is re-calculated by the slave and compared to the value sent
by the master.
Automation
If a difference is detected, the slave will not construct a response to the master.
Custumer
View Services
Slide 13 / 20

Part 3 : Modbus frame description

Frame exemple in RTU mode

Function code = 3 : Read n words
Request :
1 byte

1 byte

Slave Function
Address code = 3

2 bytes

2 bytes

2 bytes

First word
address

Number of
words to read

CRC16

2 bytes

2 bytes

2 bytes

2 bytes

Number of
bytes read

Value of the
first word

Value of the
last word

CRC16

Response :
1 byte

1 byte

Slave Function
Industrial
Address code
Automation
- =3
Custumer
View Services

Slide 14 / 20

Part 3 : Modbus frame description

Function code exemples

Code
01
02
03
04
05
06
07
08
11
12
15
16
Industrial
17

Automation Custumer
View Services

Type
Read n consecutive output bits
Read n consecutive input bits
Read n consecutive output words
Read n consecutive input words
Write 1 output bit
Write 1 output word
Read exception status
Access diagnostic counters
Read event counter
Read connection events
Write n output bits
Write n output words
Read identification

Slide 15 / 20

Part 4 : Security of transmission

Error checking methods

Parity checking
Even or odd can be optionally applied to each character.

Frame checking
LRC or CRC is applied to the entire message.

Continuous stream
The entire message frame must be transmitted as a continuous stream.
If a silent interval (more than 1.5 character times RTU mode or 1 second ASCII mode) occurs
before completion of the frame, the receiving device flushes the incomplete message and

Industrial
assumes that the next byte
Automation Custumer
View Services

will be the address field of a new message.

Slide 16 / 20

Part 4 : Security of transmission

Error checking methods

The master is configured by the user to wait for a predetermined timeout

interval before aborting the transaction.
This interval is set to be long enough for any slave to respond normally.
If the slave detects a transmission error, the message will not be acted upon.
The slave will not construct a response to the master.
Thus the timeout will expire and allow the master's program to handle the error.

Industrial
Automation Custumer
View Services

Slide 17 / 20

Part 5 : Physical layer

RS485 physical layer

RS485 is the most physical layer used on Modbus.

32 devices included the master can be connected on the bus.
This is a bus topology with line terminations.

Industrial
Automation Custumer
View Services

Slide 18 / 20

Part 6 : Main characteristics resume

Main characteristics resume

Topology:

Bus with line terminations

Maximum distance:

Data rate:

19200 bits/s maximum

Max. no. of devices:

Industrial
Automation Custumer
View Services

With RS485 : 1300 m without repeater

With RS485 : 32 master included

Slide 19 / 20

Part 6 : Main characteristics resume

Main characteristics resume

Method of accessing the medium:

Master slave

Transmission method:

Messaging

Max. useful data size:

120 words

Transmission security:

LRC or CRC
Start and stop delimiters
Parity bit
Continuous stream

Industrial
Automation Custumer
View Services

Slide 20 / 20