Understanding PLC Communication: Application and Programming of MODBUS Protocol

The underlying communication of MODBUS uses RS485 signals connected via twisted pairs, allowing for long transmission distances of up to 1000 meters, good anti-interference performance, and low cost. It is widely used in industrial control equipment communication. Many manufacturers’ variable frequency drives and controllers now adopt this protocol.

The data transmission formats include HEX code data and ASCII code, referred to as MODBUS-RTU and MODBUS-ASCII protocols, respectively. The former transmits data directly, while the latter requires conversion to ASCII code before transmission. Therefore, the communication efficiency of MODBUS-RTU is higher, it is simpler to process, and it is used more frequently.

MODBUS operates in a single master-multiple slave communication mode, using a master-slave inquiry-response method. Each communication is initiated by the master station, and the slave station responds passively. Therefore, controlled devices like variable frequency drives generally have a slave protocol built-in, while control devices like PLCs need to have both master and slave protocols.

Taking the MODBUS-RTU protocol as an example, the typical format of the communication frame is as follows: Request Frame Format: Slave Address + 0x03 + Register Starting Address + Number of Registers + CRC Check.

Normal Response Frame Format: Slave Address + 0x03 + Byte Count + Register Value + CRC Check;

Slave Address: In the master station’s sent frame, this address indicates the target receiving slave’s address; in the slave’s response frame, it indicates its own address. The slave address is set within the range of 1 to 247, with 0 being the broadcast communication address.

Operation Type: Indicates read or write operations; 0x1 = Read Coil Operation; 0x03 = Read Register Operation; 0x05 = Write Coil Operation; 0x06 = Write Register Operation.

For variable frequency drives, only 0x03 Read and 0x06 Write operations are supported. Register Starting Address: Indicates the register address to be accessed in the slave. For MD280 and MD320 series variable frequency drives, this corresponds to the “Function Code Number”, “Command Address”, and “Running Parameter Address”; Data Count: The number of consecutive data to be accessed starting from the “Register Starting Address”, measured in words for register variables.

Register Parameters (Data): The data to be rewritten (by the master) or the data to be read (by the slave response);