Understanding the MODBUS Standard Protocol

1. What is MODBUS?1. Basic Concept

MODBUS is a soft communication protocol first advocated by MODICON (now a brand of Schneider Electric), which has gradually been recognized as a standard communication protocol through practical applications by most companies. As long as data communication or transmission follows this protocol, different systems can communicate with each other. Currently, this protocol is widely adopted in RS232/RS485 communication processes.

There are two commonly used MODBUS communication protocols: MODBUS ASCII and MODBUS RTU. Generally speaking, MODBUS ASCII is used for communications with a small amount of data mainly in text form, while MODBUS RTU is used for large amounts of binary data.

In practical applications, to solve a specific problem, people often modify the MODBUS protocol to meet their needs (in fact, users frequently use their defined protocols for communication, which can solve problems but is not very standardized). A more common practice is to make minor modifications to the protocol but attach the protocol format in the software manual or directly in the help section, making it easier for users to communicate.

2. Brief Overview of the MODBUS Protocol

The ACRXXXE series instruments use the MODBUS-RTU communication protocol, which defines details such as the checksum, data sequence, and other necessary content for specific data exchanges. The MODBUS protocol uses a master-slave response connection (half-duplex) on a communication line, meaning that signals are transmitted in opposite directions along a single communication line. First, the master computer addresses a unique terminal device (slave), and then the response signal sent by the terminal device is transmitted back to the master in the opposite direction.

The MODBUS protocol only allows communication between the master (PC, PLC, etc.) and terminal devices, and does not permit data exchange between independent terminal devices. This ensures that each terminal device does not occupy the communication line during initialization and only responds to query signals directed to it.

3. Query-Response Cycle

Query

The function code in the query message indicates what function the selected slave device should perform. The data segment contains any additional information needed for the slave device to execute the function. For example, function code 03 requests the slave device to read holding registers and return their contents. The data segment must include the information to inform the slave device: from which register to start reading and the number of registers to read. The error detection field provides a method for the slave device to verify whether the message content is correct.

Response

If the slave device generates a normal response, the function code in the response message is the same as that in the query message. The data segment includes the data collected by the slave device, such as register values or statuses. If an error occurs, the function code will be modified to indicate that the response message is erroneous, and the data segment will contain a code describing the error information. The error detection field allows the master device to confirm whether the message content is usable.

4. Transmission Method:

The transmission method refers to a series of independent data structures within a data frame and the limited rules for transmitting data. Below defines the transmission method compatible with the MODBUS protocol – RTU mode.

Each byte’s bits:

· 1 start bit

· 8 data bits, with the least significant bit sent first

· No parity bit

· 1 stop bit

Error checking: CRC (Cyclic Redundancy Check)

5. Protocol

When a data frame reaches the terminal device, it enters the addressed device through a simple “port,” which removes the “envelope” (data header) from the data frame, reads the data, and if there are no errors, executes the requested task. Then, it adds its generated data to the received “envelope” and returns the data frame to the sender. The returned response data contains the following content: terminal slave address (Address), executed command (Function), requested data generated by the command (Data), and a checksum (Check). If any error occurs, there will be no successful response, or an error indication frame will be returned.

6. Data Frame Format

Address	Function	Data	Check
8-Bits	8-Bits	N x 8-Bits	16-Bits

7. Address (Address) Field

The address field is at the beginning of the frame, consisting of one byte (8 bits), with a decimal range of 0 to 255. In our system, only addresses 1 to 247 are used, while other addresses are reserved. These bits indicate the address of the terminal device specified by the user, which will receive data from the connected master. Each terminal device’s address must be unique; only the addressed terminal will respond to queries containing that address. When the terminal sends back a response, the slave address data in the response informs the master which terminal is communicating with it.

8. Function (Function) Field

The function field code tells the addressed terminal what function to perform. The table below lists the function codes used by this series of instruments, along with their meanings and functions.

Code	Meaning	Action
03	Read Data Register	Obtain the current binary values of one or more registers
16	Preset Multiple Registers	Set binary values to a series of multiple registers (not available for ACRXXXE)

9. Data (Data) Field

The data field contains the data needed for the terminal to execute specific functions or the data collected when the terminal responds to a query. The content of this data may include values, reference addresses, or set values. For example, the function field code tells the terminal to read a register, and the data field specifies from which register to start and how many data to read; the embedded addresses and data vary depending on the type and content between the slave devices.

10. Error Check (Check) Field

This field allows the master and terminal to check for errors during transmission. Sometimes, due to electrical noise and other interference, a set of data may change while being transmitted from one device to another on the line. Error checking ensures that the master or terminal does not respond to data that has changed during transmission, thus improving system safety and efficiency. Error checking uses a 16-bit cyclic redundancy method (CRC16).

11. Methods of Error Detection

Error checking (CRC) occupies two bytes and contains a 16-bit binary value. The CRC value is calculated by the transmitting device and then attached to the data frame. The receiving device recalculates the CRC value when receiving data and compares it with the value in the received CRC field. If these two values are not equal, an error has occurred.

During CRC calculation, a 16-bit register is first preset to all 1s, and each byte of the data frame is continuously XORed with the current value of that register. Only the 8 data bits of each byte participate in generating the CRC; the start and stop bits, as well as any parity bits used, do not affect the CRC. When generating the CRC, each byte’s 8 bits are XORed with the contents of the register, and the result is shifted to the low bit, with the high bit filled with “0”. The least significant bit (LSB) is shifted out and checked; if it is 1, the register is XORed with a preset fixed value (0A001H); if the least significant bit is 0, no processing is performed.

This processing is repeated until 8 shift operations are completed. After the last bit (the 8th bit) is shifted out, the next 8-bit byte is XORed with the current value of the register, and the same 8 shift XOR operations are performed. When all bytes in the data frame are processed, the final value generated is the CRC value.

The process of generating a CRC is as follows:

Ø Preset a 16-bit register to 0FFFFH (all 1s), called the CRC register.

Ø Perform an XOR operation between the 8 bits of the first byte in the data frame and the low byte of the CRC register, and store the result back in the CRC register.

Ø Shift the CRC register to the right by one bit, filling the highest bit with 0 and shifting out the lowest bit for detection.

Ø If the lowest bit is 0: repeat step three (next shift); if the lowest bit is 1: perform an XOR operation between the CRC register and a preset fixed value (0A001H).

Ø Repeat steps three and four until 8 shifts are completed. This processes a complete eight bits.

Ø Repeat steps two to five to process the next eight bits until all bytes are processed.

Ø The final value of the CRC register is the CRC value.

Additionally, there is a method of calculating CRC using a preset table, which is characterized by fast computation speed, but requires a large amount of storage space for the table. This method will not be elaborated here; please refer to related materials.

13. Detailed Explanation of Communication Application Format

This section will use examples in the format shown in the figure as much as possible (numbers are in hexadecimal).

Addr	Fun	Data start reg hi	Data start reg lo	Data #of regs hi	Data #of regs lo	CRC16 lo	CRC16 hi
01H	03H	00H	00H	00H	03H	05H	CBH

Addr: Slave Address

Fun: Function Code

Data start reg hi: Data Start Address High Byte

Data start reg lo: Data Start Address Low Byte

Data #of regs hi: Number of Registers to Read High Byte

Data #of regs lo: Number of Registers to Read Low Byte

CRC16 Hi: Cyclic Redundancy Check High Byte

CRC16 Lo: Cyclic Redundancy Check Low Byte

14. Read Data (Function Code 03)

Query Data Frame

This function allows users to obtain data collected and recorded by the device and system parameters. There is no limit to the number of data requested by the master at one time, but it cannot exceed the defined address range.

The following example reads three basic data collected from Slave 01 (each address in the data frame occupies 2 bytes): UA, UB, UC, where UA’s address is 0025H, UB’s address is 0026H, and UC’s address is 0027H.

Addr	Fun	Data start	Addr hi	Data start	Addr lo	Data #of	regs hi	Data #of	regs lo	CRC16 lo	CRC16 hi
01H	03H	00H	25H	00H	03H	14H	00H

Response Data Frame

The response includes the slave address, function code, number of data, and CRC error check.

The following example shows the response for reading UA, UB, UC (UA=082CH, UB=082AH, UC=082CH).

Addr	Fun	Byte count	Data1 hi	Data1 lo	Data2 hi	Data2 lo	Data3 hi	Data3 lo	CRC16 lo	CRC16 hi
01H	03H	06H	08H	2CH	08H	2AH	08H	2CH	94H	4EH

Error Indication Code

If the address requested by the master does not exist, it will return an error indication code: FFH.

2. FeaturesMODBUS has the following characteristics:

1. Standard and open; users can use the MODBUS protocol freely and with confidence without paying license fees or infringing intellectual property rights. Currently, more than 400 manufacturers support MODBUS, with over 600 products supporting it.

2. MODBUS can support multiple electrical interfaces, such as RS-232, RS-485, etc., and can also be transmitted over various media, such as twisted pair, fiber optics, wireless, etc.

3. The MODBUS frame format is simple, compact, and easy to understand. It is easy for users to use and simple for manufacturers to develop.

3. Function Code Definitions1. ModBus Function Codes

01	READ COIL STATUS
02	READ INPUT STATUS
03	READ HOLDING REGISTER
04	READ INPUT REGISTER
05	WRITE SINGLE COIL
06	WRITE SINGLE REGISTER
15	WRITE MULTIPLE COIL
16	WRITE MULTIPLE REGISTER

4. Transmission Method

In the ModBus system, there are two transmission modes to choose from. These two transmission modes are equivalent to the capabilities of the slave PC in communication. The choice should depend on the ModBus master used; each ModBus system can only use one mode, and mixing two modes is not allowed. One mode is ASCII (American Standard Information Exchange Code), and the other mode is RTU (Remote Terminal Unit).

Users select the desired mode, including serial communication parameters (baud rate, parity, etc.), when configuring each controller. All devices on a Modbus network must select the same transmission mode and serial parameters. The chosen ASCII or RTU mode is only applicable to standard Modbus networks, which define every bit of the message segments continuously transmitted on these networks and determine how to package information into message fields and how to decode it. On other networks (like MAP and Modbus Plus), Modbus messages are converted into frames independent of serial transmission.

1. Transmission Mode Characteristics

ASCII printable characters facilitate fault detection and are suitable for master computers and master PCs programmed in high-level languages (such as Fortran). RTU is suitable for computers and PC masters programmed in machine language.

Data transmitted in RTU mode is 8-bit binary characters. To convert to ASCII mode, each RTU character should first be divided into high and low parts, each containing 4 bits, and then converted into hexadecimal equivalent values. The ASCII characters used to form the message are all hexadecimal characters. Although the characters used in ASCII mode are twice that of RTU mode, decoding and processing ASCII data is somewhat easier; furthermore, in RTU mode, message characters must be transmitted in a continuous data stream, while in ASCII mode, there can be a delay of up to 1 second between characters to accommodate slower machines.

The controller can be set to either of the two transmission modes (ASCII or RTU) for standard Modbus network communication.

2. ASCII Mode

When the controller is set to communicate in ASCII (American Standard Information Exchange Code) mode on the Modbus network, each 8-bit byte in a message is transmitted as 2 ASCII characters. For example, the value 63H in ASCII mode requires sending two bytes, namely ASCII “6” (0110110) and ASCII “3” (0110011). The ASCII characters occupy 7 bits and 8 bits, with the internationally used 7 bits being the most common. The main advantage of this method is that the time interval between character transmissions can reach 1 second without causing errors.

Code System

• Hexadecimal, ASCII characters 0…9, A…F

• Each ASCII character in the message consists of a hexadecimal character. Each byte’s bits:

• 1 start bit

• 7 data bits, with the least significant bit sent first

• 1 parity bit; if no parity, then no 1 stop bit (with parity) or 2 bits (without parity); error detection field

• LRC (Longitudinal Redundancy Check)

3. RTU Mode

When the controller is set to communicate in RTU mode on the Modbus network, each 8-bit byte in a message is transmitted as is, without processing. For example, 63H will be directly sent as 01100011 in RTU mode. The main advantage of this method is that there are no gaps between data frame transmissions, and at the same baud rate, the data density transmitted is higher than that of ASCII, resulting in faster transmission speeds.

Code System

• 8-bit binary, hexadecimal numbers 0…9, A…F

• Each 8-bit field in the message consists of one or two hexadecimal characters

• Each byte’s bits: 1 start bit, 8 data bits, with the least significant bit sent first

• 1 parity bit; if no parity, then no

• 1 stop bit (with parity), 2 bits (without parity)

5. Data Checking Methods1. CRC

The CRC field is two bytes, containing a 16-bit binary value. It is calculated by the transmitting device and added to the message. The receiving device recalculates the CRC of the received message and compares it with the value in the received CRC field. If the two values differ, an error has occurred.

CRC is initially loaded with a 16-bit register where all bits are 1. Then, a process is called to handle the continuous 8-bit bytes in the message and the current value in the register. Only the 8-bit data in each character is effective for CRC; the start and stop bits and parity bits are invalid.

During CRC generation, each 8-bit character is XORed with the contents of the register (XOR), and the result is shifted towards the least significant bit, with the most significant bit filled with 0. The LSB is extracted for detection; if LSB is 1, the register is XORed with a preset value; if LSB is 0, no processing is done. This process is repeated 8 times. After the last bit is completed, the next 8-bit byte is also XORed with the current value of the register. The final value in the register is the CRC value after all bytes in the message have been processed.

The steps to generate the CRC-16 check byte are as follows:

① Load a 16-bit register with all bits as 1.

② Perform an XOR operation between the high byte of the first 8-bit byte and the CRC register. Store the result in the CRC register.

③ Shift the CRC register to the right by one bit.

④ If the shifted-out bit is 1, XOR the register with the polynomial; if it is 0, go back to step 3.

⑤ Repeat steps 3 and 4 until 8 bits are shifted out.

⑥ XOR the next 8-bit byte with the CRC register.

⑦ Repeat steps 3 to 6 until all bytes in the message have been XORed with the 16-bit register and 8 shifts have been performed.

⑧ The contents of the 16-bit register become the 2-byte CRC check, which is added to the message’s most significant bit. Additionally, in some non-ModBus communication protocols, CRC16 is also frequently used as a check method, and several variants of CRC16 have been generated, using different initial values for the 16-bit register.

2. LRC

LRC error checking is used in ASCII mode. This error check is an 8-bit binary number that can be transmitted as 2 ASCII hexadecimal bytes. The hexadecimal characters are converted into binary, and the binary values are summed without carry to generate the LRC error check. This LRC is verified by the receiving device and compared with the transmitted LRC. Any non-ASCII hexadecimal characters in the message are ignored during calculation.

Comparison of Modbus and PROFIBUS-DP Protocols

The Modbus protocol is completely open, simple, and easy to implement. Microcontrollers, PLCs, and DCS can all easily implement it.

Profibus, on the other hand, is more complex, requiring dedicated chips for secondary development and certification from higher organizations, resulting in higher development costs.

Of course, in terms of performance, serial-based Modbus RTU/ASCII communication cannot compare with Profibus DP, but for simple communication or small data volume communication at the instrument level, Modbus is sufficient. In short, Modbus is the ‘common man’, while Profibus is the ‘rich and handsome’!

Function Codes Supported by Modbus

Function Code	Name	Function
01	Read Coil Status	Obtain the current status of a group of logical coils (ON/OFF)
02	Read Input Status	Obtain the current status of a group of switch inputs (ON/OFF)
03	Read Holding Register	Obtain the current binary values in one or more holding registers
04	Read Input Register	Obtain the current binary values in one or more input registers
05	Force Single Coil	Force the ON/OFF state of a logical coil
06	Preset Single Register	Load a specific binary value into a holding register
15	Force Multiple Coils	Force the ON/OFF state of a series of consecutive logical coils
16	Preset Multiple Registers	Load specific binary values into a series of consecutive holding registers

Detailed Explanation of Function Code Commands

Among these function codes, the most commonly used are 1, 2, 3, 4, 5, and 6, which can be used to perform read and write operations on digital and analog quantities of the lower machine.

1. Command 01, Read Writable Digital Registers (Coil Status):

The computer sends the command: [Device Address] [Command Number 01] [High 8 Bits of Starting Register Address] [Low 8 Bits] [High 8 Bits of Number of Registers to Read] [Low 8 Bits] [Low 8 Bits of CRC Check] [High 8 Bits of CRC Check]

Example: [11][01][00][13][00][25][CRC Low][CRC High]

Meaning:

<1> Device Address: Multiple devices can be connected on a 485 bus, and this device address indicates which device to communicate with. In this example, it is communicating with device number 17 (decimal 17 is hexadecimal 11).

<2> Command Number 01: The command number for reading digital quantities is fixed at 01.

<3> Starting Address High 8 Bits, Low 8 Bits: Indicates the starting address of the switch quantity to be read (starting address is 0). In this example, the starting address is 19.

<4> Number of Registers High 8 Bits, Low 8 Bits: Indicates how many switch quantities to read from the starting address. In this example, it is 37 switch quantities.

<5> CRC Check: It checks from the beginning up to this point. The device response: [Device Address] [Command Number 01] [Returned Number of Bytes] [Data 1] [Data 2] … [Data n] [High 8 Bits of CRC Check] [Low 8 Bits of CRC Check]

Example: [11][01][05][CD][6B][B2][0E][1B] [CRC High] [CRC Low]

Meaning:

<1> Device Address and Command Number are the same as above.

<2> Returned Number of Bytes: Indicates the number of data bytes, which is the value of n in Data 1, 2 … n.

<3> Data 1 … n: Since each data is an 8-bit number, each data represents the value of 8 switch quantities, where each bit being 0 indicates the corresponding switch is off, and 1 indicates it is on. For example, in this example, it indicates that switch number 20 (index number 19) is closed, switch number 21 is off, switch number 22 is closed, switch number 23 is closed, switch number 24 is off, switch number 25 is off, switch number 26 is closed, and switch number 27 is closed … If the queried switch quantity is not a multiple of 8, then the high part of the last byte is meaningless and set to 0.

<4> CRC Check is the same as above.

2. Command 05, Write Digital Quantity (Coil Status):

The computer sends the command: [Device Address] [Command Number 05] [High 8 Bits of Register Address to be Set] [Low 8 Bits] [High 8 Bits of Data to be Set] [Low 8 Bits] [Low 8 Bits of CRC Check] [High 8 Bits of CRC Check]

Example: [11][05][00][AC][FF][00][CRC High][CRC Low]

Meaning:

<1> Device Address is the same as above.

<2> Command Number: The command number for writing digital quantities is fixed at 05.

<3> Register Address to be Set: Indicates the address of the switch to be set.

<4> Data to be Set: Indicates the state of the switch to be set. In this example, it closes the switch. Note that only [FF][00] can indicate closure and [00][00] indicates disconnection; other values are invalid.

<5> Note that this command can only set the state of one switch at a time.

The device response: If it successfully returns the command sent by the computer, otherwise it does not respond.

3. Command 03, Read Writable Analog Registers (Holding Registers):

The computer sends the command: [Device Address] [Command Number 03] [High 8 Bits of Starting Register Address] [Low 8 Bits] [High 8 Bits of Number of Registers to Read] [Low 8 Bits] [High 8 Bits of CRC Check] [Low 8 Bits of CRC Check]

Example: [11][03][00][6B][00][03][CRC High][CRC Low]

Meaning:

<1> Device Address is the same as above.

<2> Command Number: The command number for reading analog quantities is fixed at 03.

<3> Starting Address High 8 Bits, Low 8 Bits: Indicates the starting address of the analog quantity to be read (starting address is 0). In this example, the starting address is 107.

<4> Number of Registers High 8 Bits, Low 8 Bits: Indicates how many analog quantities to read from the starting address. In this example, it is 3 analog quantities. Note that in the returned information, one analog quantity requires two bytes to return.

Device response: [Device Address] [Command Number 03] [Returned Number of Bytes] [Data 1] [Data 2] … [Data n] [High 8 Bits of CRC Check] [Low 8 Bits of CRC Check]

Example: [11][03][06][02][2B][00][00][00][64][CRC High][CRC Low]

Meaning:

<1> Device Address and Command Number are the same as above.

<2> Returned Number of Bytes: Indicates the number of data bytes, which is the value of n in Data 1, 2 … n. In this example, 3 analog quantities are returned, as one analog quantity requires 2 bytes, totaling 6 bytes.

<3> Data 1 … n: where [Data 1][Data 2] are the high and low bytes of the first analog quantity, [Data 3][Data 4] are the high and low bytes of the second analog quantity, and so on. In this example, the returned values are 555, 0, and 100.

<4> CRC Check is the same as above.

4. Command 06, Write Single Analog Quantity Register (Holding Register):

The computer sends the command: [Device Address] [Command Number 06] [High 8 Bits of Register Address to be Set] [Low 8 Bits] [High 8 Bits of Data to be Set] [Low 8 Bits] [High 8 Bits of CRC Check] [Low 8 Bits of CRC Check]

Example: [11][06][00][01][00][03][CRC High][CRC Low]

Meaning:

<1> Device Address is the same as above.

<2> Command Number: The command number for writing analog quantities is fixed at 06.

<3> Register Address to be Set: Indicates the address of the analog quantity register to be set.

<4> Data to be Set: Indicates the analog quantity data to be set. For example, this sets the value of register 1 to 3.

<5> Note that this command can only set the state of one analog quantity at a time.

The device response: If it successfully returns the command sent by the computer, otherwise it does not respond.

5. Command 16, Write Multiple Analog Quantity Registers (Holding Registers):

The computer sends the command: [Device Address] [Command Number 16] [High 8 Bits of Register Address to be Set] [Low 8 Bits] [High 8 Bits of Number of Data to be Set] [Low 8 Bits] [High 8 Bits of Data to be Set] [Low 8 Bits] … [High 8 Bits of CRC Check] [Low 8 Bits of CRC Check]

Example: [11][16][00][01][00][01][00][05][CRC High][CRC Low]

Meaning:

<1> Device Address is the same as above.

<2> Command Number: The command number for writing analog quantities is fixed at 16.

<3> Register Address to be Set: Indicates the address of the analog quantity register to be set.

<4> Number of Data to be Set: Indicates how many data need to be set, which is 1 here.

<5> Data to be Set: Indicates the analog quantity data to be set. For example, this sets the value of register 1 to 5.

The device response: If it successfully returns the command sent by the computer, otherwise it does not respond. The device response: [Device Address] [Command Number 16] [High 8 Bits of Register Address to be Set] [Low 8 Bits] [High 8 Bits of Number of Data to be Set] [Low 8 Bits] [High 8 Bits of CRC Check] [Low 8 Bits of CRC Check], as in the above example: [11][16][00][01][00][01][CRC High][CRC Low]

Disclaimer

Unless otherwise stated, the content on this site comes from the internet, WeChat public accounts, and other public media channels, aimed at conveying more information. The content is for reference only and does not guarantee the accuracy of the article, nor does it represent the views of this site. It is for reference and communication purposes only. The copyright of the reproduced articles belongs to the original author or institution. If there is any infringement of copyright, please inform us, and we will delete it within 24 hours!

Previous Review Links:

1. Historical article review, more benefits and materials to be obtained

2. Free download of data center infrastructure operation and maintenance materials package

3. Data center infrastructure engineering acceptance checklist – Excel electronic form

Scan to Join Group and Get More Operation and Maintenance Materials