Industrial Communication: Chapter 2: Modbus Serial

Industrial Communication
Chapter 2: Modbus Serial

Modbus Serial Features
Industrial Communication Course with Unity Pro - Modbus

Schneider Electric | Industry Business | Training | E. Pauchet V5.0 May 2010 2
Introduction
Modbus = Modicon Bus (1979)

is an application layer messaging protocol for client/server communication
between devices connected on the bus.
Independent from the other layers
Openly published and royalty-free
Relatively easy industrial network to deploy
It moves raw bits or words without placing many restrictions on vendors
Various versions
Modbus RTU (Serial), Modbus ASCII, Modbus Ethernet TCP/IP, Modbus
Plus (Proprietary of =S=)

Layers Used in OSI Model
3 Layers used for Modbus Serial
APPLICATION Modbus Protocol
PRESENTATION Not used
SESSION Not used
TRANSPORT Not used
NETWORK Not used
DATALINK Master / Slave, Transmission RTU / ASCII
PHYSICAL RS485, RS422, Fiber Optic, Radio, Cellular,

Physical Layer
Required Multi-point and
RS485 2 wire point-to-point
To integrate into an
RS485 4 wire Optional
existing installation
without modification
RS232 Optional Point-to-point mode

15 meter max.
Transmission speeds:
9600 bps and 19200 bps required with 19.2 Kbps by default
Other speeds: 1200, 2400, 4800, 38400, 56 Kbps, 115 Kbps optional
RS485 is the most common physical layer used on Modbus. 32

devices included the master can be connected on the bus.
Modbus RS485 2 wire installation
Master
T
R
5V
650 ohms
Balanced pair
650 ohms 120 ohms
120 ohms
1 nF
Common 1 nF
PG
R R
T T
Slave 1 Slave n Max. number of devices:

32 including master without a repeater
Max. length:
Main segment: 1,000 m at 19,200 bits/s
Topology: bus type Drops: 40 m in total (20 m for one tap link)

Data Transmission
Method of accessing the medium

Master slave
Transmission method:
Client / Server
Max. useful data size:

120 words

Unicast Addressing Mode
Address = 1 to 247
Request
Funct.
5 Code
Request data CRC
Adr 1 Adr 2 Adr 3 Adr 4 Adr 5 Adr n
Response
Funct.
5 Code
Response data CRC

Broadcast Addressing Mode
Address = 0
Request
Funct.
0 Code
Request data CRC
Adr 1 Adr 2 Adr 3 Adr 4 Adr 5 Adr n
No response from slaves
Used only with write functions

Transmission Modes
ASCII transmission mode

Every data item is encoded in two ASCII characters (7 bits)
allows time intervals of up to 1 second to occur between characters without
causing an error.
Used with Modem / Barcodes
RTU transmission mode

Every data item is encoded in one byte (8 bits)
Achieves higher throughput & reliability
Used with PLC / SCADA

Modbus Serial Frame
Modbus PDU
PDU = Protocol Data Unit
Function
Address Data CRC or LRC
Code
= 0 to 247 = 1 to 127 Additional data depending Validity

Identifies the Action to on the Function Code check
addressee perform
Unicast Address field = 1 to 247

Two
addressing Broadcast Address field = 0
modes:
(used in write only mode)

Address Field
Address Function Data Checksum
Valid device addresses : 0 to 247 decimal. Value 0

reserved for broadcast message (no reponse)
Request
A master addresses a slave by placing the slave address in the address
field of the message.
Response
When the slave sends its response, it places its own address in this address
field of the response to let the master know which slave is responding.

Function Field
Valid codes are in the range of 1

to 255 decimal.
Request
The function code field tells the slave what kind of action to perform.
Response
For a normal response, the slave simply echoes the original function code.
For an exception response, the slave returns a code that is equivalent to the
original function code with its most significant bit set to a logic 1.

Data Field
Request
The data field contains additional information which the slave must use to
take the action defined by the function code. This can include items like
register addresses, quantity of items to be handled, etc...
Response
If no error occurs, the data field contains the data requested.
If an error occurs, the field contains an exception code that the master.
Application used to determine the next action to be taken.

Checksum Field
Modbus RTU uses CRC

Cyclical Redundancy Check (2 bytes)
Modbus ASCII uses LRC
Longitudinal Redundancy Check (1 byte)
Request
The checksum is calculated by the master and sends to the slave.
Response
The checksum is re-calculated by the slave and compared to the value sent
by the master. If a difference is detected, the slave will not construct a
response to the master.

Function Codes
Code Function
01 (0x01) Read n consecutive output bits

02 (0x02) Read n consecutive input bits
03 (0x03) Read n consecutive output words
04 (0x04) Read n consecutive input words
05 (0x05) Write 1 output bit
06 (0x06) Write 1 output word
07 (0x07) Read exception status
08 (0x08) Access diagnostic counters
15 (0x0F) Write n output bits
16 (0x10) Write n output words
23 (0x17) Read/Write n output words
43 (0x2B) Read identification
http://www.modbus.org
Example of Read Request
Request
1 byte 1 byte 2 bytes 2 bytes 2 bytes
Slave Function First word Number of
CRC16
Address code = 3 address words to read
Response
1 byte 1 byte 2 bytes 2 bytes 2 bytes 2 bytes
Slave Function Number of Value of the Value of the
last word CRC16
Address code = 3 bytes read first word

Registers & Index
Registers
Memory variable located in a device
Word, Bit, Byte, etc
Can be reached thanks to its Index
Inputs Registers: read only (status)

Outputs Registers: read / write (commands)

Programming Modbus with Unity Pro

1 Platform, 3 Target
3 PLC Targets
M340, Premium, Quantum
Same Philosophy
Different Function Blocks

BMXNOM0200
Safety screw (1)

Display block with 4 LEDs: (2)
RUN (green) and ERR (red): Module status
SER COM (green): Activity on the serial link (lit) or
fault (flashing).
Channel 0 (3a & 3b)
RS 232C connection, marked COM Port 0 RS232
RS 485 connection, marked COM Port 0 RS485
Channel 1 (4)
RS 485 connection, marked COM Port 1 RS485

BMXNOM0200 Configuration

Request Programming
Dedicated Function Blocks for M340
ADDM
Address Conversion
READ_VAR
Execute a read request
WRITE_VAR
Execute a write request
DATA_EXCH
Execute a user defined request
OUT_IN_MBUS
Change from Slave to Master mode
ADDM FB
IN:
String variable: r.m.c.e.MBS
Out
Converted table of words, to be used in the others FB
r.m.c.e.MBS
r = the rack number where the Modbus module is located,
m = the slot number of the Modbus module,
c = the channel used
e = the equipment address (slave address) of the target
MBS = used to indicates to use Modbus Serial (optional)

READ_VAR FB
IN:
ADR: to be linked to the output of the ADDM block.
OBJ: defining object to read (in the case of Modbus register: %MW)
NUM: starting register to read
NB: number of consecutive register to read
OUT
RECP: reception zone of the block, delivering the value read (table of
words)
IN/OUT
GEST: table of 4 words to manage the communication block (errors,
timeout, length, etc..)

WRITE_VAR FB
IN:
ADR: to be linked to the output of the ADDM block.
OBJ: defining object to write (in the case of Modbus register: %MW)
NUM: starting register to write
NB: number of registers to write
EMIS: source table to write from the PLC
IN/OUT
GEST: table of 4 words to manage the communication block (errors,
timeout, length, etc..)

GEST Variable
Structured Variable
Table of 4 words
Most Significant Byte Least Significant Byte
GEST[1] Exchange number (updated Activity bit: 1 = exchange in

each time the request is progress, 0 = exchange
executed) terminated.
GEST[2] Operation report Communication Report
GEST[3] Timeout
GEST[4] Length

Exercise
Add & Configure Modbus Module (p 2-13)

Add a module
Configure the channel
Set the Modbus Slave address (Tesys U)
Insert the ADDM block
Create the READ_VAR request (to read status register
index 455)
Test the application

Optimizing Communication
Beware of Communication Buffer Overload
Usage of the Activity Bit (GEST[1].X0)

Optimizing Communication (Example)
Conditioning with the Activity Bit

Avoid buffer overload
Ensure that the next block is send when the previous is finished.

Optimizing Communication (Cont.)
Device Timeout
Mean to know if the Master is lost
After a defined time without receiving request, Slave goes to fallback mode
Allo, anybody
still there?
Fallback Mode
Mode activated when communication is lost
Behaviour to define (start a motor, stop a process, switch off outputs..)
No
answers
great, lets go
party!

Exercise
Optimizing the Communication (2-16)

Insert the Activity Bit as condition
Insert the WRITE_VAR function (to write into command
register 704)
Test the communication
Testing the TimeOut (2-20)

Use WRITE_VAR to change the Timeout parameter
Test the communication

Modbus Serial RTU
Main Features Reminder:

Up to 1200m whatever the baud rate value
Performance: Depends on the PLC application and how its managed.
Up to 32 Devices (31 slaves)
Baudrates: 1,2kbit/s... 19,2kbit/s
max 240 bytes per telegram
No separate ground wire
Good error detection (CRC)


Industrial Communication: Chapter 2: Modbus Serial

Caricato da

Informazioni sul documento

Titolo originale

Copyright

Formati disponibili

Condividi questo documento

Condividi o incorpora il documento

Opzioni di condivisione

Hai trovato utile questo documento?

Questo contenuto è inappropriato?

Copyright:

Formati disponibili

Industrial Communication: Chapter 2: Modbus Serial

Caricato da

Copyright:

Formati disponibili

Industrial Communication

Chapter 2: Modbus Serial

Industrial Communication Course with Unity Pro - Modbus

Modbus = Modicon Bus (1979)

Industrial Communication Course with Unity Pro - Modbus

3 Layers used for Modbus Serial

APPLICATION Modbus Protocol

PRESENTATION Not used

SESSION Not used

TRANSPORT Not used

NETWORK Not used

DATALINK Master / Slave, Transmission RTU / ASCII

PHYSICAL RS485, RS422, Fiber Optic, Radio, Cellular,

Industrial Communication Course with Unity Pro - Modbus

RS232 Optional Point-to-point mode

RS485 is the most common physical layer used on Modbus. 32

Slave 1 Slave n Max. number of devices:

Industrial Communication Course with Unity Pro - Modbus

Method of accessing the medium

Max. useful data size:

Industrial Communication Course with Unity Pro - Modbus

Adr 1 Adr 2 Adr 3 Adr 4 Adr 5 Adr n

Industrial Communication Course with Unity Pro - Modbus

Adr 1 Adr 2 Adr 3 Adr 4 Adr 5 Adr n

No response from slaves

Used only with write functions

Industrial Communication Course with Unity Pro - Modbus

ASCII transmission mode

RTU transmission mode

Industrial Communication Course with Unity Pro - Modbus

= 0 to 247 = 1 to 127 Additional data depending Validity

Unicast Address field = 1 to 247

Industrial Communication Course with Unity Pro - Modbus

Address Function Data Checksum

Valid device addresses : 0 to 247 decimal. Value 0

Industrial Communication Course with Unity Pro - Modbus

Address Function Data Checksum

Valid codes are in the range of 1

Industrial Communication Course with Unity Pro - Modbus

Address Function Data Checksum

Industrial Communication Course with Unity Pro - Modbus

Modbus RTU uses CRC

Industrial Communication Course with Unity Pro - Modbus

01 (0x01) Read n consecutive output bits

Industrial Communication Course with Unity Pro - Modbus

Inputs Registers: read only (status)

Industrial Communication Course with Unity Pro - Modbus

Industrial Communication Course with Unity Pro - Modbus

Different Function Blocks

Industrial Communication Course with Unity Pro - Modbus

Safety screw (1)

Industrial Communication Course with Unity Pro - Modbus

Industrial Communication Course with Unity Pro - Modbus

Industrial Communication Course with Unity Pro - Modbus

Industrial Communication Course with Unity Pro - Modbus

Industrial Communication Course with Unity Pro - Modbus

Most Significant Byte Least Significant Byte

GEST[1] Exchange number (updated Activity bit: 1 = exchange in

GEST[2] Operation report Communication Report

Industrial Communication Course with Unity Pro - Modbus

Add & Configure Modbus Module (p 2-13)

Industrial Communication Course with Unity Pro - Modbus

Beware of Communication Buffer Overload