Understanding the MODBUS Standard Protocol

MODBUS is a soft communication protocol initially advocated by MODICON (now a brand of Schneider Electric). After practical application by most companies, it has gradually been recognized and has become a standard communication protocol. As long as data communication or transmission follows this protocol, different systems can communicate. Currently, this protocol is widely used in RS232/RS485 communication.

There are two commonly used MODBUS communication protocols: one is MODBUS ASCII and the other is MODBUS RTU. Generally, MODBUS ASCII is used for communication with a small amount of data and mainly text, while MODBUS RTU is used when the communication data volume is large and consists of binary values.

In practical applications, to solve a specific problem, people prefer to modify the MODBUS protocol to meet their needs (in fact, people often use self-defined protocols for communication, which can solve problems but are not very standardized). A more common practice is to make minor modifications to the protocol but attach the protocol format with the software documentation or directly place it in the help section, making it easier for users to communicate.

The ACRXXXE series instruments use the MODBUS-RTU communication protocol, which defines the checksum, data sequence, etc., all of which are necessary for specific data exchange. The MODBUS protocol uses a master-slave response connection (half-duplex) on a single communication line, meaning signals are transmitted in opposite directions along a single communication line. First, the master computer addresses a unique terminal device (slave), and then the response signal sent by the terminal device is transmitted back to the master.

The MODBUS protocol only allows communication between the master (PC, PLC, etc.) and terminal devices, and does not permit data exchange between independent terminal devices, so that each terminal device does not occupy the communication line when initializing, but only responds to the query signals directed to it.

Query

The function code in the query message informs the selected slave device what function to perform. The data segment contains any additional information the slave device needs to execute the function. For example, function code 03 requests the slave device to read holding registers and return their contents. The data segment must contain the information to tell the slave device where to start reading and how many registers to read. The error detection field provides a way for the slave device to verify whether the message content is correct.

Response

If the slave device generates a normal response, the function code in the response message is the same as the function code in the query message. The data segment includes the data collected by the slave device, such as register values or status. If an error occurs, the function code will be modified to indicate that the response message is erroneous, and the data segment will contain a code describing the error. The error detection field allows the master device to confirm whether the message content is valid.

The transmission method refers to a series of independent data structures within a data frame and the limited rules used for data transmission. Below is the definition of the transmission method compatible with the MODBUS-RTU protocol.

Each byte consists of:

· 1 start bit

· 8 data bits, sent with the least significant bit first

· No parity bit

· 1 stop bit

Error checking: CRC (Cyclic Redundancy Check)

When a data frame reaches the terminal device, it enters the addressed device through a simple “port,” removes the “envelope” (data header) of the data frame, reads the data, and if there are no errors, performs the requested task, then generates its own data and adds it to the received “envelope,” returning the data frame to the sender. The returned response data contains the following: terminal slave address (Address), executed command (Function), requested data generated by the executed command (Data), and a checksum (Check). If any error occurs, there will be no successful response, or an error indication frame will be returned.

The address field is at the beginning of the frame, consisting of one byte (8-bit binary code), with a decimal range of 0-255, but only 1-247 is used in our system, with other addresses reserved. These bits indicate the address of the terminal device specified by the user, which will receive data from the connected master. Each terminal device’s address must be unique, and only the addressed terminal will respond to the queries containing that address. When the terminal sends back a response, the slave address data in the response tells the master which terminal is communicating with it.

The function code informs the addressed terminal what function to perform. The table below lists the function codes used by this series of instruments, along with their meanings and functions.

The data field contains the data required for the terminal to perform specific functions or the data collected when the terminal responds to a query. The content of this data may be values, reference addresses, or set values. For example, the function code tells the terminal to read a register, and the data field specifies from which register to start and how many data to read, with embedded addresses and data varying based on type and content between the slave devices.

This field allows the master and terminal to check for errors during transmission. Sometimes, due to electrical noise and other interference, a set of data may change while being transmitted from one device to another. Error checking ensures that neither the master nor the terminal responds to data that has changed during transmission, thereby improving system safety and efficiency. Error checking uses a 16-bit cyclic redundancy method (CRC16).

Error checking (CRC) occupies two bytes and contains a 16-bit binary value. The CRC value is calculated by the transmitting device and then added to the data frame. The receiving device recalculates the CRC value upon receiving the data and compares it with the value in the received CRC field; if these two values are not equal, an error has occurred.

During the CRC operation, a 16-bit register is first preset to all 1s, and then each byte of data in the data frame is processed with the current value of that register. Only the 8 data bits of each byte participate in generating the CRC; the start bit, stop bit, and any parity bits used do not affect the CRC. During CRC generation, each byte’s 8 bits are XORed with the contents of the register, and the result is shifted to the low bit; the high bit is padded with “0”. The lowest bit (LSB) is shifted out and checked; if it is 1, the register performs an XOR operation with a preset fixed value (0A001H); if the lowest bit is 0, no further action is taken.

This process is repeated until 8 shift operations are completed. After the last bit (the 8th bit) is shifted out, the next 8-bit byte is XORed with the current value of the register. The same series of 8 shift XOR operations is performed until all bytes in the data frame are processed; the final value generated is the CRC value.

In addition, there is also a method of calculating CRC using a preset table, which is characterized by fast calculation speed, but the table requires a large storage space. This method will not be elaborated here; please refer to relevant materials.

Ø Pre-set a 16-bit register to 0FFFFH (all 1s), referred to as the CRC register.

Ø XOR the 8 bits of the first byte in the data frame with the low byte of the CRC register, and store the result back in the CRC register.

Ø Shift the CRC register to the right by one bit; the high bit is filled with 0, and the low bit is shifted out and checked.

Ø If the lowest bit is 0: repeat step three (next shift); if the lowest bit is 1: perform an XOR operation between the CRC register and a preset fixed value (0A001H).

Ø Repeat steps three and four until 8 shifts are completed. This processes one complete byte.

Ø Repeat steps two to five to process the next byte until all bytes are processed.

Ø The final value of the CRC register is the CRC value.

In addition, there is a method of calculating CRC using a preset table, which is characterized by fast calculation speed, but the table requires a large storage space. This method will not be elaborated here; please refer to relevant materials.

This section will try to use the format shown in the figure as much as possible (numbers are in hexadecimal).

Addr: Slave address

Fun: Function code

Data start reg hi: Data start address register high byte

Data start reg lo: Data start address register low byte

Data #of reg hi: Number of registers to read high byte

Data #of reg lo: Number of registers to read low byte

CRC16 Hi: Cyclic Redundancy Check high byte

CRC16 Lo: Cyclic Redundancy Check low byte

Query Data Frame

This function allows users to obtain data collected and recorded by the device and system parameters. There is no limit to the number of data items requested by the master at one time, but it cannot exceed the defined address range.

The following example reads three collected basic data items (UA, UB, UC) from slave 01, where the address of UA is 0025H, UB is 0026H, and UC is 0027H.

Response Data Frame

The response contains the slave address, function code, the number of data items, and CRC error check.

The following example shows the response for reading UA, UB, UC (UA=082CH, UB=082AH, UC=082CH).

Error Indication Code

If the address requested by the master does not exist, the error indication code FFH will be returned.

<

1. Standard, open, users can use the Modbus protocol freely and safely without paying licensing fees or infringing on intellectual property rights. Currently, there are over 400 manufacturers supporting Modbus, with over 600 products supporting it.

2. Modbus can support multiple electrical interfaces, such as RS-232, RS-485, etc., and can also be transmitted over various media such as twisted pair, fiber optics, and wireless.

3. The frame format of Modbus is simple, compact, and easy to understand. It is easy for users to use and simple for manufacturers to develop.

There are two transmission modes available in the ModBus system. These two transmission modes are equivalent to the communication capabilities of the slave PC. The choice should depend on the ModBus master used; each ModBus system can only use one mode, and mixing two modes is not allowed. One mode is ASCII (American Standard Information Exchange Code), and the other mode is RTU (Remote Terminal Unit).

Users choose the desired mode, including serial communication parameters (baud rate, parity, etc.), when configuring each controller. All devices on a Modbus network must select the same transmission mode and serial port parameters. The selected ASCII or RTU mode applies only to standard Modbus networks, defining how each bit of messages transmitted continuously on these networks is packaged into message fields and how to decode them. In other networks (like MAP and Modbus Plus), Modbus messages are converted into frame formats independent of serial transmission.

ASCII printable characters facilitate fault detection and are suitable for master computers and PCs programmed in high-level languages (such as Fortran). RTU, on the other hand, is suitable for computers and PC hosts programmed in machine language.

Data transmitted in RTU mode consists of 8-bit binary characters. To convert to ASCII mode, each RTU character should first be divided into high and low parts, each containing 4 bits, and then converted into hexadecimal equivalents. The ASCII characters used to form messages are all hexadecimal characters. Although the characters used in ASCII mode are twice that of RTU mode, decoding and processing ASCII data is somewhat easier. Additionally, in RTU mode, message characters must be transmitted in a continuous data stream, while in ASCII mode, there can be a gap of up to 1 second between characters to accommodate slower machines.

The controller can be set to either of the two transmission modes (ASCII or RTU) for standard Modbus network communication.

When the controller is set to communicate in ASCII (American Standard Information Exchange Code) mode on the Modbus network, each 8-bit byte in a message is transmitted as 2 ASCII characters. For example, the value 63H in ASCII mode requires sending two bytes, namely ASCII “6” (0110110) and ASCII “3” (0110011). The bits used for ASCII characters can be 7 bits and 8 bits, with the internationally common 7 bits being more common. The main advantage of this method is that the time interval for sending characters can reach 1 second without causing errors.

Code System

• Hexadecimal, ASCII characters 0…9, A…F

• Each ASCII character in the message consists of a hexadecimal character forming each byte’s bits

• 1 start bit

• 7 data bits, with the least significant bit sent first

• 1 parity bit; if no parity, then 1 stop bit (with parity), 2 bits (without parity) error detection field

• LRC (Longitudinal Redundancy Check)

When the controller is set to communicate in RTU mode on the Modbus network, each 8-bit byte in the message is transmitted in its original value without processing, such as 63H, which RTU will directly send as 01100011. The main advantage of this method is that there is no gap between data frame transmissions, leading to higher data density and faster transmission speed at the same baud rate compared to ASCII.

Code System

• 8-bit binary, hexadecimal numbers 0…9, A…F

• Each 8-bit field in the message consists of one or two hexadecimal characters

• Each byte’s bits: 1 start bit, 8 data bits, with the least significant bit sent first

• 1 parity bit; if no parity, then no

• 1 stop bit (with parity), 2 bits (without parity)

The CRC field is two bytes, containing a 16-bit binary value. It is calculated by the transmitting device and added to the message. The receiving device recalculates the CRC of the received message and compares it with the value in the received CRC field; if the two values are different, an error occurs.

CRC is first loaded with a value of all “1” in a 16-bit register, then a process is called to handle the continuous 8-bit bytes in the message with the current value of the register. Only the 8-bit data in each character is valid for the CRC; start bits, stop bits, and parity bits are invalid.

During the CRC generation process, each 8-bit character is individually XORed with the register content (XOR), and the result is shifted towards the least significant bit, with the most significant bit filled with 0. The LSB is extracted for detection; if the LSB is 1, the register performs an XOR operation with a preset value; if the LSB is 0, no operation is performed. This process is repeated for 8 shifts. After completing the last bit, the next 8-bit byte is XORed with the current value of the register. The final value in the register after processing all bytes is the CRC value.

When the CRC is added to the message, the low byte is added first, followed by the high byte.

The CRC-16 error checking process is as follows: the message (here only concerning data bits, not start bits, stop bits, and optional parity bits) is viewed as a continuous binary, with the most significant bit (MSB) sent first. The message is first multiplied by X^16 (left-shifted 16 bits), and then divided by X^16 + X^15 + X^2 + 1. The polynomial X^16 + X^15 + X^2 + 1 can be represented as the binary number 11000,0000,0000,0101. The integer quotient is ignored, and the 16-bit remainder is added to the message (MSB sent first) to become the two CRC check bytes. All 1s in the remainder are initialized to prevent all zeros from being received as a message. After this process, the message containing the CRC bytes, if error-free, will yield a zero remainder when divided by the same polynomial at the receiving device (the receiving device verifies this CRC byte and compares it with the transmitted CRC).

Devices accustomed to sending data in streams will prefer to send the rightmost character (LSB). In generating the CRC, however, the first bit sent should be the highest significant bit (MSB) of the dividend. Since no carry is used in the operation, for ease of operation, the MSB is considered to be on the rightmost side during CRC calculation. The bit order of the polynomial must also be reversed for consistency. The MSB of the polynomial is ignored, as it only affects the quotient and does not affect the remainder.

The steps to generate the CRC-16 check bytes are as follows:

① Load a 16-bit register with all bits set to 1.

② XOR the high byte of this 16-bit register with the first 8 bits of the message. The result is stored in this 16-bit register.

③ Shift this 16-bit register to the right by one bit.

④ If the bit shifted out to the right (the marked bit) is 1, XOR the generated polynomial with this register; if the bit shifted out is 0, return to step 3.

⑤ Repeat steps 3 and 4 until 8 bits are shifted out.

⑥ XOR the next 8 bits with this 16-bit register.

⑦ Repeat steps 3-6 until all bytes of the message have been XORed with the 16-bit register and shifted 8 times.

⑧ The content of this 16-bit register is the 2-byte CRC error check, added to the highest significant bit of the message. Additionally, some non-ModBus communication protocols also frequently use CRC16 as a check method, which has produced some variants of CRC16 using the polynomial X^16 + X^15 + X^2 + 1, where the initially loaded 16-bit register is 0000; using CRC16 in reverse order X^16 + X^14 + X^1 + 1, where the initial loaded register value is 0000 or FFFFH.

The LRC error check is used in ASCII mode. This error check is an 8-bit binary number that can be transmitted as 2 ASCII hexadecimal bytes. The hexadecimal characters are converted to binary, summed with the binary characters without cyclic carry, and the binary complement result generates the LRC error check (see figure). This LRC is verified by the receiving device and compared with the transmitted LRC, ignoring colons (:), carriage return symbols (CR), line feed characters (LF), and any other non-ASCII hexadecimal characters during the calculation.

The content of the Modbus protocol is fully open, simple, and very easy to implement. Microcontrollers, PLCs, and DCS can all be easily implemented.

Profibus is somewhat more complex, requiring specialized chips for secondary development and certification from superior organizations, resulting in higher development costs.

Of course, in terms of performance, serial-based Modbus RTU/ASCII communication cannot match Profibus DP. However, for simple communications at the instrument level or small data volume communications at the controller level, Modbus is sufficient. In simple terms, Modbus is a *poor guy, while Profibus is a rich and handsome guy!

Among these function codes, the ones most frequently used are codes 1, 2, 3, 4, 5, and 6, which allow for reading and writing digital and analog values from the lower-level devices.

1. Command 01, Read Writable Digital Registers (Coil Status):

The computer sends the command: [Device Address] [Command Number 01] [Starting Register Address High 8 Bits] [Low 8 Bits] [Number of Registers to Read High 8 Bits] [Low 8 Bits] [CRC Check Low 8 Bits] [CRC Check High 8 Bits]

Example: [11][01][00][13][00][25][CRC Low][CRC High]

The meaning is as follows:

<1> Device Address: Multiple devices can be connected on a 485 bus; the device address here indicates which device to communicate with. In this example, it communicates with device number 17 (decimal 17 is hexadecimal 11).

<2> Command Number 01: The command number for reading digital quantities is fixed at 01.

<3> Starting Address High 8 Bits, Low 8 Bits: Indicates the starting address of the switch quantity to be read (starting address is 0). For example, the starting address in this example is 19.

<4> Number of Registers High 8 Bits, Low 8 Bits: Indicates how many switch quantities to read starting from the starting address. In this example, it is 37 switch quantities.

<5> CRC Check: Checked from the beginning to this point. The device response: [Device Address] [Command Number 01] [Returned Byte Count] [Data 1] [Data 2] … [Data n] [CRC Check High 8 Bits] [CRC Check Low 8 Bits]

Example: [11][01][05][CD][6B][B2][0E][1B] [CRC High] [CRC Low]

The meaning is as follows:

<1> Device Address and Command Number are the same as above.

<2> Returned Byte Count: Indicates the number of data bytes, which is the value of n in Data 1, 2 … n.

<3> Data 1 … n: Since each data is an 8-bit number, each data represents the value of 8 switch quantities, with each bit being 0 indicating the corresponding switch is off and 1 indicating it is on. For example, in this example, it indicates that switch number 20 (index number 19) is on, switch number 21 is off, switch number 22 is on, switch number 23 is on, switch number 24 is off, switch number 25 is off, switch number 26 is on, switch number 27 is on … If the number of switch quantities queried is not a multiple of 8, the high part of the last byte is meaningless and set to 0.

<4> CRC Check is the same as above.

2. Command 05, Write Digital Quantity (Coil Status):

The computer sends the command: [Device Address] [Command Number 05] [Register Address to be Set High 8 Bits] [Low 8 Bits] [Data to be Set High 8 Bits] [Low 8 Bits] [CRC Check Low 8 Bits] [CRC Check High 8 Bits]

Example: [11][05][00][AC][FF][00][CRC High][CRC Low]

The meaning is as follows:

<1> Device Address is the same as above.

<2> Command Number: The command number for writing digital quantities is fixed at 05.

<3> Register Address to be Set High 8 Bits, Low 8 Bits: Indicates the address of the switch to be set.

<4> Data to be Set High 8 Bits, Low 8 Bits: Indicates the state of the switch to be set. In this example, it closes that switch. Note that only [FF][00] indicates closing and [00][00] indicates opening; other values are illegal.

<5> Note that this command can only set the state of one switch at a time.

The device response: If the command sent by the computer is successfully returned as is, otherwise there is no response.

3. Command 03, Read Writable Analog Registers (Holding Registers):

The computer sends the command: [Device Address] [Command Number 03] [Starting Register Address High 8 Bits] [Low 8 Bits] [Number of Registers to Read High 8 Bits] [Low 8 Bits] [CRC Check High 8 Bits] [CRC Check Low 8 Bits]

Example: [11][03][00][6B][00][03][CRC High][CRC Low]

The meaning is as follows:

<1> Device Address is the same as above.

<2> Command Number: The command number for reading analog quantities is fixed at 03.

<3> Starting Address High 8 Bits, Low 8 Bits: Indicates the starting address of the analog quantity to be read (starting address is 0). For example, the starting address in this example is 107.

<4> Number of Registers High 8 Bits, Low 8 Bits: Indicates how many analog quantities to read starting from the starting address. In this example, it is 3 analog quantities. Note that in the returned information, one analog quantity requires two bytes to return.

Device Response: [Device Address] [Command Number 03] [Returned Byte Count] [Data 1] [Data 2] … [Data n] [CRC Check High 8 Bits] [CRC Check Low 8 Bits]

Example: [11][03][06][02][2B][00][00][00][64][CRC High][CRC Low]

The meaning is as follows:

<1> Device Address and Command Number are the same as above.

<2> Returned Byte Count: Indicates the number of data bytes, which is the value of n in Data 1, 2 … n. In this example, it returns data for 3 analog quantities, requiring a total of 6 bytes.

<3> Data 1 … n: where [Data 1][Data 2] are the high and low bytes of the first analog quantity, [Data 3][Data 4] are the high and low bytes of the second analog quantity, and so on. In this example, the returned values are 555, 0, and 100.

<4> CRC Check is the same as above.

4. Command 06, Write Single Analog Register (Holding Register)

The computer sends the command: [Device Address] [Command Number 06] [Register Address to be Set High 8 Bits] [Low 8 Bits] [Data to be Set High 8 Bits] [Low 8 Bits] [CRC Check High 8 Bits] [CRC Check Low 8 Bits]

Example: [11][06][00][01][00][03][CRC High][CRC Low]

The meaning is as follows:

<1> Device Address is the same as above.

<2> Command Number: The command number for writing analog quantities is fixed at 06.

<3> Register Address to be Set High 8 Bits, Low 8 Bits: Indicates the address of the analog quantity register to be set.

<4> Data to be Set High 8 Bits, Low 8 Bits: Indicates the data for the analog quantity to be set. For example, in this case, it sets the value of register 1 to 3.

<5> Note that this command can only set the state of one analog quantity at a time.

The device response: If the command sent by the computer is successfully returned as is, otherwise there is no response.

5. Command 16, Write Multiple Analog Registers (Holding Registers)

The computer sends the command: [Device Address] [Command Number 16] [Register Address to be Set High 8 Bits] [Low 8 Bits] [Data Quantity High 8 Bits] [Data Quantity Low 8 Bits] [Data to be Set High 8 Bits] [Low 8 Bits] […] [CRC Check High 8 Bits] [CRC Check Low 8 Bits]

Example: [11][16][00][01][00][01][00][05][CRC High][CRC Low]

The meaning is as follows:

<1> Device Address is the same as above.

<2> Command Number: The command number for writing analog quantities is fixed at 16.

<3> Register Address to be Set High 8 Bits, Low 8 Bits: Indicates the address of the analog quantity register to be set.

<4> Number of Data to be Set High 8 Bits, Low 8 Bits: Indicates how many data items need to be set; here it is 1.

<5> Data to be Set High 8 Bits, Low 8 Bits: Indicates the analog quantity data to be set. For example, in this case, it sets the value of register 1 to 5.

The device response: If the command sent by the computer is successfully returned as is, otherwise there is no response. The device response: [Device Address] [Command Number 16] [Register Address to be Set High 8 Bits] [Low 8 Bits] [Data Quantity High 8 Bits] [Data Quantity Low 8 Bits] [CRC Check High 8 Bits] [CRC Check Low 8 Bits], as shown in the example: [11][16][00][01][00][01][CRC High][CRC Low]

Source from the internet, copyright belongs to the original author. If there is any infringement, please contact to delete!