Ing.

Marcelo Garcia T

MODBUS

Modbus.org :
http://www.modbus.org
Modicon site for Modbus users.

Transparent Factory :
http://www.transparentfactory.com
Schneider Electric site for Transparent Factory users.

Modbus Plus :
http://www.modicon.com/techpubs/toc6.html
Modbus Plus Planning and installation.

Diseado en 1979 por Modicon para su gama

de controladores lgicos programables
(PLCs).
Las razones por las cuales el uso de Modbus
es superior a otros protocolos de
comunicaciones son:

es pblico.
su implementacin es fcil y requiere poco desarrollo.
maneja bloques de datos sin suponer restricciones.

Basado en la arquitectura maestro/esclavo o

cliente/servidor.
Existen versiones del protocolo Modbus para
puerto serie y Ethernet (Modbus/TCP).

Introduccin

Modbus Client (Master)

SCADA

RS-232/485

Modbus Device (Slave)

HMI

Interne
t

Modbus Device (Slave)

Application Structure (general)

Query
Station Number
Function Code
Data Bytes
(Flexible)

Error Check

Station Number
Function Code
Data Bytes
(Flexible)

Error Check

Response

Query-Response Cycle

P.5

MODBUS Protocol is a messaging structure created by MODICON

company to connect PLC to programming tools.

It is now widely used to establish master-slave communication between

intelligent devices.
MODBUS is independent of the physical layer.
It can be implemented using RS232, RS422, or RS485 or over a variety
of media (e.g. fiber, radio, cellular, etc...).

MODBUS

Referncia: MODBUS Application Protocol Specification V1.1b

MODBUS PLUS is a higher speed network 1 Mbit/s token passing derivative

that uses the MODBUS messaging structure.

7 Application

Modbus

6 Presentation
5

Session

4 Transport
3

Network

2 Link

802.4 Token passing

1 Physical

RS485

MODBUS TCP/IP uses TCP/IP and Ethernet 10 Mbit/s or 100

Mbits/s to carry the MODBUS messaging structure.

7 Application

Modbus

6 Preentation
5

Session

4 Transport
3

Network

2 Link
1 Physical

TCP
IP

CSMA / CD
ETHERNET V2 ou 802.3

Modbus con enlace serie, opera de 1200bps a

56Kbps con mtodo de acceso maestro/esclavo

Modbus modelo ISO

10

Modbus Plus. Es un bus que opera a

1Mbps y el mtodo de acceso est basado
en Token-Ring

Modbus modelo ISO

11

Modbus Ethernet TCP/IP. Utiliza la

capa fsica Ethernet con velocidades de 10
Mbps y 100 Mbps y protocolos TCP/IP.

Modbus modelo ISO

12

Ej. Arquitectura de una red Modbus

13

Medio: Cable de par trenzado apantallado.

Topologa: Bus.
Distancia: mx. 1300 m., entre
repetidores.
Velocidad: 1200 bps/56Kbps.
Nodos: 32 (1 master y 31 esclavos)
Conectores: RJ-45, SUB-DB9

Capa Fsica RS-485

14

Mtodo de acceso al medio:

master/eslave.
Mtodo de transmisin: Cliente-Servidor.
Seguridad en la transmisin:
CRC y LCR
Bit de Start y Stop
Bit de paridad
Flujo continuo (control de flujo)

Capa de Enlace

15

The MODBUS protocol comes in 2 versions :

ASCII transmission mode
Each eight-bit byte in a message is sent as 2 ASCII characters.
RTU transmission mode
Each eight-bit byte in a message is sent as two four-bit
hexadecimal
characters.

The main advantage of the RTU mode is that it achieves higher

throughput.
ASCII mode allows time intervals of up to 1 second to occur between
characters without causing an error.

The Modbus frame structure is the same for requests (master to

slave messages) and responses (slave to master messages).
Modbus RTU
silence

Address

Function

Data

Checksum

silence

Silence >= 3,5 characters

Modbus ASCII
:

3A Hex

Address

Function

Data

Checksum

CR LF

0D Hex 0A Hex

Address Function

Data

Checksum

Valid slave device addresses are in the range of 0 ... 247 decimal.
The individual slave devices are assigned addresses in the range of 1 ... 247.
Value 0 is reserved for broadcast messages (no response).
Request :
A master addresses a slave by placing the slave address in the address field of
the message.
Response :
When the slave sends its response, it places its own address in this address field
of the response to let the master know which slave is responding.

Address Function

Data

Checksum

Valid codes are in the range of 1 ... 255 decimal.

Request :

The function code field tells the slave what kind of action to perform.
Response :

For a normal response, the slave simply echoes the original function code.
For an exception response, the slave returns a code that is equivalent to
the original function code with its most significant bit set to a logic 1.

Part 3 : Modbus frame description

Data field
Address Function

Data

Checksum

Valid codes are in the range of 0 ... 255 decimal.

Request :

The data field contains additional information which the slave must use to tak
the action defined by the function code. This can include items like register
addresses, quantity of items to be handled, etc...
Response :

If no error occurs, the data field contains the data requested.

If an error occurs, the field contains an exception code that the master
application can use to determine the next action to be taken.

Address Function

Data

Checksum

Valid codes are in the range of 0 ... 255 decimal.

Modbus RTU uses CRC :
Modbus ASCII uses LRC :

Cyclycal Reduncy Check (2 byte)

Longitudinal Redundancy Check (1 bytes)

Request :

The checksum is calculated by the master and sends to the slave.

Response :

The checksum is re-calculated by the slave and compared to the value sent
by the master.
If a difference is detected, the slave will not construct a response to the master.

 Function code = 3 : Read n words

Request :
1 byte

1 byte

2 bytes

2 bytes

2 bytes

Slave Function First word Number of

CRC16
Address code = 3
address words to read

Response :
1 byte

1 byte

2 bytes

2 bytes

Slave Function Number of Value of the

Address code = 3 bytes read
first word

2 bytes

2 bytes

Value of the
last word

CRC16

ASCII Mode

RTU Mode
1 Char

Start

Station NumberFunction Code Data

2 Chars
2 Chars
n Chars

Error Check End

2 Chars
2 Chars
LRC
CR,LF

Station NumberFunction Code Data

n Chars

Error Check End

2 Chars
3.5 Chars

Start

Modbus
Plus network 1 Char
3.5 Char 1 Char
Silence

Byte 0, 1: transaction ID usually 0

Byte 2,
3:Station
protocol
ID = 0
Prefixed
Data
NumberFunction
Code Data
4, 5: number of bytes following
6Byte
x 8 Bits

Modbus Message Packet

CRC

Silence

01:
02:
03:
04:
05:
06:
15:
16:

read DOs (0xxxx)

read DIs (1xxxx)
read AOs (4xxxx)
read AIs (3xxxx)
write single DO (0xxxx)
write single AO (4xxxx)
wirte DOs (0xxxx)
write AOs (4xxxx)

Modbus Function Code

P.24

Code

Type

01
02
03
04
05
06
07
08
11
12
15
16
17

Read n consecutive output bits

Read n consecutive input bits
Read n consecutive output words
Read n consecutive input words
Write 1 output bit
Write 1 output word
Read exception status
Access diagnostic counters
Read event counter
Read connection events
Write n output bits
Write n output words
Read identification

 Parity checking
Even or odd can be optionally applied to each character.

Frame checking
LRC or CRC is applied to the entire message.

Continuous stream
The entire message frame must be transmitted as a continuous stream.
If a silent interval (more than 1.5 character times RTU mode or 1 second ASCII mode)
occurs before completion of the frame, the receiving device flushes the incomplete
message and assumes that the next byte will be the address field of a new message.

The master is configured by the user to wait for a predetermined

timeout

interval before aborting the transaction.

This interval is set to be long enough for any slave to respond normally.
If the slave detects a transmission error, the message will not be acted
upon.
The slave will not construct a response to the master.
Thus the timeout will expire and allow the master's program to handle
the error.

RS485 is the most physical layer used on Modbus.

32 devices included the master can be connected on the bus.
This is a bus topology with line terminations.