Understanding the Modbus Communication Protocol

Modbus Communication Protocol

The Modbus protocol is arguably the most widely used communication protocol in the field of industrial automation. Its openness, scalability, and standardization make it a universal industrial standard. With it, products from different manufacturers can be easily and reliably connected to the network, enabling centralized monitoring and decentralized control functions.

Currently, the main Modbus specifications in use are ASCII, RTU, and TCP, without specifying the physical layer. The common interface forms for Modbus include RS-232C, RS485, and RS422, as well as the RJ45 interface. The Modbus ASCII and RTU protocols define the structure of messages, data, commands, and responses based on these interfaces. Modbus data communication adopts a Master/Slave mode, where the Master sends a data request message, and upon receiving the correct message, the Slave can send data back to the Master in response to the request. The Master can also send messages directly to modify Slave data, allowing for bidirectional read/write operations.

In serial communication, the “baud rate” describes the data transmission rate. An international standard baud rate series is defined: 110, 300, 600, 1200, 1800, 2400, 4800, 9600, 14.4Kbps, 19.2Kbps, 28.8Kbps, 33.6Kbps, 56Kbps. For example, 9600bps indicates a transmission of 9600 bits per second, including character bits and other necessary bits such as start bits, stop bits, and parity bits.

In the field of automation, we often use the RTU mode. The format of each byte in RTU mode is as follows:

Encoding System: 8-bit binary, hexadecimal 0-9, A-F

Data Bits: 1 start bit

8 data bits, with the low bit sent first

1 bit for odd/even parity; 0 bits if no parity

1 stop bit with parity; 2 stop bits without parity

Error Check Area: Cyclic Redundancy Check (CRC)

Slave Address Setting: The information address includes 2 characters (ASCII) or 8 bits (RTU), with valid slave device addresses ranging from 0-247 (decimal).

Function Code Setting: The function code in the information frame includes characters (ASCII) or 8 bits (RTU). The valid code range is 1-225 (decimal);

Content of the Data Area: The data area contains 2 hexadecimal data bits, with data ranging from 00-FF (hexadecimal). Depending on the method of serial transmission, the data area can consist of a pair of ASCII characters or a single RTU character.

Message Frame in RTU Mode:

Function Codes of Modbus:

Mapping of Modbus Function Codes and Data Types:

Example of Reading Full Data in RTU Mode:

Analysis: The host sends a command to access the slave address 1 using function code 03 (read holding registers), with the starting address high 8 bits and low 8 bits indicating the desired analog starting address (starting address is 0). For example, in this case, the starting address is 38, which is decimal 56. The number of registers high 8 bits and low 8 bits indicates how many analog values to read starting from the starting address. In this example, it is 1 analog value. Note that in the returned information, one analog value requires two bytes to return. Error checking is done using CRC.

Slave Response: The device address and command number are the same as above. The number of returned bytes indicates the number of data bytes, which is the value of n in data 1, 2…n. In this example, 1 analog value’s data is returned, as one analog value requires 2 bytes, totaling 2 bytes. The high and low bytes of data: 41 and 24 represent the value of the returned 1 analog value, which is decimal 16676. Error checking is done using CRC.

End