Getting Started with Modbus and Fieldbus (Part 1)
In PLC applications, after understanding hardware configuration and logic programming, a significant part of the work involves handling field communication. There are various fieldbus protocols, which actually follow certain patterns. The most commonly seen fieldbus protocol on-site is probably Modbus.
When I first encountered Modbus, I also learned a new word, “De facto”. After checking several dictionaries, I found out it means “in fact”. Modbus can indeed be called the de facto industrial standard. Modbus was developed by Modicon (which has undergone several acquisitions and is now part of Schneider Electric, with Modicon still being a brand name for some of Schneider’s PLCs) in 1979 for communication between programmable logic controllers (PLCs). To show off my extensive knowledge (and love for gossip), I will speculate on the origin of this term for easier memorization. Modicon is likely an abbreviation for Modular Control, and since Modbus is the first generation communication bus of Modicon, it could be understood as Modular bus: “a modular bus” seems a bit forced, but understanding it as Modicon’s communication bus, Modicon Bus, fits better. The reason Modbus can become the de facto standard in industrial communication protocols, I speculate, is mainly due to two reasons: first, Modicon was one of the earliest companies to produce PLCs, and second, it is probably because it is “simple”.
Later, the Modbus protocol also released an upgraded version, Modbus Plus (MB+), but it did not become popular because Modicon did not make the protocol public, although it is still widely used in industrial sites.
The earliest Modbus was based on serial communication (EIA/TIA) RS232/485/422 technology, with a simple and user-friendly protocol, requiring minimal hardware. It gradually exceeded the scope of PLC communication and was widely used in various industrial communications, with many instruments and controllers supporting this protocol, including circuit breakers in the power distribution field. Later, with the popularity of industrial Ethernet, the Modbus protocol has also been used as an application layer protocol over Ethernet, still appearing in various industrial and civilian sites. For those familiar with network communication protocol models, the following diagram clearly shows the position and function of the Modbus protocol.
Next, I will detail the contents of the Modbus protocol, hoping to use this “de facto industrial standard” as an example to introduce you to the various communication standards.
The communication network we rely on every day may not be unfamiliar to you, but only a few people probably understand its working principles. I saw an explanation online using the process of ordering takeout to illustrate the structure of the standardized network model (OSI) defined by the International Organization for Standardization (ISO), which is quite fitting. You can check it out when you have time.
A simple understanding of the OSI network model:
https://www.versatek.com/blog/you-wont-believe-what-the-osi-model-and-pizza-have-in-common/
I have made a comparison of several common networks (models) for easier understanding. Of course, the content of the telephone network is not rigorous, and is for reference only.
Getting Started with Modbus and Fieldbus (Part 2)
As an application layer protocol, Modbus was originally designed for communication between PLCs, so the basic protocol content is relatively simple, and the transmitted data is mainly divided into four categories: discrete input (switching), discrete output (switching, coils), input registers, and holding registers. Corresponding to the terms in the power system, they are: remote signaling, remote control, remote measurement, and remote adjustment. In practical use, since one holding register can be used as sixteen switching quantities and supports both reading and writing, everyone is accustomed to handling everything through reading/writing holding registers.
The original Modbus protocol was based on RS-232/485 links, with two encoding methods, RTU and ASCII. This is also why you sometimes see the term “Modbus RTU”; the frame format we will introduce later is the RTU format, while the ASCII format is rarely used now.
In fact, the communication format of Modbus is very easy to understand. The master sends a message to the slave, which is roughly equivalent to a user asking Alipay:
Alipay (slave address), what is the second place (data type, holding register) of the predetermined lucky fish (register address) (read data, secret code 03)? (checksum)? The message format is as follows (in hexadecimal):
|
01 |
03 |
00 01 |
00 01 |
D5 CA |
|
Slave Address |
Function Code |
Data Address |
Number of Data to Read |
CRC Check |
Alipay replies to the user:
Alipay (slave address), well (repeat read data function code), no (return data length, two), it is 0017 (returned data), really not (checksum):
|
01 |
03 |
02 |
0017 |
F8 4A |
|
Slave Address |
Function Code |
Number of Data Bytes |
Two Bytes of Data |
CRC Check |
In this way, the Modbus master completes a read operation of the slave data; isn’t it simple? The two most commonly used function codes are the ones introduced above: 0x03 (read multiple holding registers) and 0x10 (decimal 16, write multiple holding registers). Other function codes are basically similar, differing only in the types (discrete, registers, etc.) and quantities (individual, multiple continuous) of combinations. Of course, error handling and other details are also included; for detailed content, see the references.
The register address starts from 0000, corresponding to 40001 in Modicon (Schneider) PLCs. If the register address starts from 0001 and directly corresponds to register address 40001, the Modbus RTU protocol has an alias JBUS, which can be understood as JBUS being a commonly used subset of Modbus. Additionally, some manufacturers return data with lengths calculated not by bytes but by words, which cannot be compatible with the standard Modbus protocol.
By removing the address and CRC checksum from the Modbus message and embedding it into the Ethernet data frame, it becomes TCP-Modbus, as shown in the diagram below. In this way, serial devices (like the circuit breakers we mentioned earlier, which mostly become serial devices through attachments) can easily connect to Ethernet; of course, this “embedding” process is completed by a gateway.
The main content of the Modbus protocol has been introduced, and we will find that, as an application layer protocol, Modbus does not define the format and meaning of the data. For example, when reading the value of a holding register, we obtain a 16-bit number, but whether this number represents the state of each bit as a switching quantity, an unsigned integer, or the high or low byte of a 32-bit floating-point number must be defined by both communicating parties. Therefore, a significant part of implementing Modbus communication involves processing according to the communication data table of both parties.
Source/ China Industrial Control Network Forum
Previous Highlights ▼
A comprehensive guide to common electronic component testing methods and experiences~
Test your safety awareness! Do you really understand safety?
Organized | A quick guide to understanding inverters and their application industries
Confused about whether to buy PNP or NPN sensors?
[Prize Collection] Are you the industrial dreamer we are looking for?
What is shaft current? What harm does shaft current do to bearings?
[Opinion] Will SCL become the mainstream programming language for PLCs?
The relationship between the placement of weighing sensors and test results, gaining more knowledge!
PLC | Are you familiar with Siemens PLC? Have you used this language?
To some extent, the shortest distance between industrial control professionals is just a small secretary away. Follow me to gain more resources and information. The little secretary will take you on a journey through a broader new world of industrial intelligence!
— Information Secretary
Click “Read Original” to see more