Modbus

Modbus is a data communications protocol originally published by Modicon (now Schneider Electric) in 1979 for use with its programmable logic controllers (PLCs). Modbus has become a "de facto" standard communication protocol and is now a commonly available means of connecting industrial electronic devices.
Modbus is popular in industrial environments because it is openly published and royalty-free. It was developed for industrial applications, is relatively easy to deploy and maintain compared to other standards, and places few restrictions - other than the datagram (packet) size - on the format of the data to be transmitted.
The Modbus protocol uses character serial communication lines, Ethernet, or the Internet protocol suite as a transport layer.
Modbus supports communication to and from multiple devices connected to the same cable or Ethernet network. For example, there can be a device that measures temperature and another device to measure humidity connected to the same cable, both communicating measurements to the same computer.
Modbus is often used to connect a plant/system supervisory computer with a remote terminal unit (RTU) in Supervisory Control and Data Acquisition (SCADA) systems in the electric power industry. Many of the data types are named from industrial control of factory devices, such as Ladder logic because of its use in driving relays: A single physical output is called a "coil", and a single physical input is called a "discrete input" or a "contact".
The development and update of Modbus protocols have been managed by the Modbus Organization since April 2004, when Schneider Electric transferred rights to that organization. The Modbus Organization is an association of users and suppliers of Modbus-compliant devices that advocates for the continued use of the technology.
Modbus object types.
The following is a table of object types provided by a Modbus slave device to a Modbus master device:
Protocol versions.
Versions of the Modbus protocol exist for serial port and for Ethernet and other protocols that support the Internet protocol suite. There are many variants of Modbus protocols:
Data model and function calls are identical for the first 4 variants of protocols; only the encapsulation is different. However the variants are not interoperable, nor are the frame formats.
Communications and devices.
Each device communicating (i.e., transferring data) on a Modbus is given a unique address.
On Modbus RTU, Modbus ASCII and Modbus Plus (which are all RS-485 single cable multi-drop networks), only the node assigned as the Master may initiate a command. All other devices are slaves and respond to requests and commands.
For the protocols using Ethernet such as Modbus TCP, any device can send out a Modbus command thus all can act as a Master, although normally only one device acts as a Master.
There are many modems and gateways that support Modbus, as it is a very simple and often copied protocol. Some of them were specifically designed for this protocol. Different implementations use wireline, wireless communication, such as in the ISM band, and even Short Message Service (SMS) or General Packet Radio Service (GPRS). One of the more common designs of wireless networks makes use of mesh networking. Typical problems that designers have to overcome include high latency and timing issues.
Commands.
Modbus commands can instruct a Modbus Device to:
A Modbus command contains the Modbus address of the device it is intended for (1 to 247). Only the addressed device will respond and act on the command, even though other devices might receive it (an exception is specific broadcastable commands sent to node 0, which are acted on but not acknowledged).
All Modbus commands contain checksum information to allow the recipient to detect transmission errors.
Frame formats.
A Modbus "frame" consists of an Application Data Unit (ADU), which encapsulates a Protocol Data Unit (PDU):
The byte order for values in Modbus data frames is most significant byte of a multi-byte value is sent before the others. All Modbus variants use one of the following frame formats.
Modbus RTU frame format (primarily used on asynchronous serial data lines like RS-485/EIA-485).
Note about the CRC:
Modbus ASCII frame format (primarily used on 7- or 8-bit asynchronous serial lines).
Address, function, data, and LRC are all capital hexadecimal readable pairs of characters representing 8-bit values (0–255). For example, 122 (7 × 16 + 10) will be represented as codice_7.
LRC is calculated as the sum of 8-bit values (excluding the start and end characters), negated (two's complement) and encoded as an 8-bit value. Example: if address, function, and data encode as 247, 3, 19, 137, 0, and 10, their sum is 416. Two's complement (−416) trimmed to 8 bits is 96 (e.g. 256 × 2 − 416), which will be represented as codice_8 in hexadecimal. Hence the following frame: codice_9. It is specified for use only as a checksum: because it calculated on the encoded data rather than the transmitted characters, its 'Longitudinal' characteristic is not available for use with parity bits to locate single-bit errors.
Modbus TCP frame format (primarily used on Ethernet networks).
"Unit identifier" is used with Modbus/TCP devices that are composites of several Modbus devices, e.g. on Modbus/TCP to Modbus RTU gateways. In such case, the unit identifier tells the Slave Address of the device behind the gateway. Natively Modbus/TCP-capable devices usually ignore the Unit Identifier.
Available function/command codes.
The various reading, writing and other operations are categorized as follows. The most primitive reads and writes are shown in bold. A number of sources use alternative terminology, for example "Force Single Coil" where the standard uses "Write Single Coil".<br>Prominent entities within a Modbus slave are:
Format of data of requests and responses for main function codes.
Requests and responses follow frame formats described above. This section gives details of data formats of most used function codes.
Function code 1 (read coils) and function code 2 (read discrete inputs).
Request:
Normal response:
Value of each coil/discrete input is binary (0 for off, 1 for on). First requested coil/discrete input is stored as least significant bit of first byte in reply.<br>
If number of coils/discrete inputs is not a multiple of 8, most significant bit(s) of last byte will be stuffed with zeros.<br>
For example, if eleven coils are requested, two bytes of values are needed. Suppose states of those successive coils are "on, off, on, off, off, on, on, on, off, on, on", then the response will be codice_10 in hexadecimal.
Because the byte count returned in the reply message is only 8 bits wide and the protocol overhead is 5 bytes, a maximum of 2008 (251 x 8) discrete inputs or coils can be read at once.
Function code 5 (force/write single coil).
Request:
Normal response: same as request.
Function code 15 (force/write multiple coils).
Request:
Value of each coil is binary (0 for off, 1 for on). First requested coil is stored as least significant bit of first byte in request.<br>
If number of coils is not a multiple of 8, most significant bit(s) of last byte should be stuffed with zeros. See example for function codes 1 and 2.<br>
<br>
Normal response:
Function code 4 (read input registers) and function code 3 (read holding registers).
Request:
Normal response:
Because the maximum length of a Modbus PDU is 253 (inferred from the maximum Modbus APU length of 256 on RS485), only up to 125 registers can be requested at once.
Function code 6 (preset/write single holding register).
Request:
Normal response: same as request.
Function code 16 (preset/write multiple holding registers).
Request:
Because register values are 2-bytes wide and only 127 bytes worth of values can be sent, only 63 holding registers can be preset/written at once.
Normal response:
Exception responses.
For a normal response, slave repeats the function code. Should a slave want to report an error, it will reply with the requested function code plus 128 (hex codice_11) (3 becomes 131 = hex codice_12), and will only include one byte of data, known as the "exception code".
Coil, discrete input, input register, holding register numbers and addresses.
Some conventions govern how Modbus entities (coils, discrete inputs, input registers, holding registers) are referenced.
It is important to make a distinction between entity "number" and entity "address":
In the traditional standard, entity "numbers" start with a single digit representing the entity type, followed by four digits representing the entity location:
For data communications, the entity "location" (1 to 9,999) is translated into a 0-based entity "address" (0 to 9,998) by subtracting 1.
For example, in order to read holding registers starting at "number" 40001, the data frame will contain function code 3 (as seen above) and "address" 0. For holding registers starting at "number" 40100, "address" will be 99. Etc.
This limits the number of "addresses" to 9,999 for each entity. A "de facto" referencing extends this to the maximum of 65,536.
It simply consists of adding one digit to the previous list:
When using the extended referencing, all "number" references must have exactly 6 digits. This avoids confusion between coils and other entities. For example, to know the difference between holding register #40001 and coil #40001, if coil #40001 is the target, it must appear as #040001.
JBUS mapping.
Another "de facto" protocol closely related to Modbus appeared after it, and was defined by PLC brand April Automates, the result of a collaborative effort between French companies Renault Automation and Merlin Gerin et Cie in 1985: JBUS. Differences between Modbus and JBUS at that time (number of entities, slave stations) are now irrelevant as this protocol almost disappeared with the April PLC series which AEG Schneider Automation bought in 1994 and then made obsolete. However the name JBUS has survived to some extent.
JBUS supports function codes 1, 2, 3, 4, 5, 6, 15, and 16 and thus all the entities described above. However numbering is different with JBUS:
Implementations.
Almost all implementations have variations from the official standard. Different varieties might not communicate correctly between equipment of different suppliers. Some of the most common variations are:
Trade group.
Modbus Organization, Inc. is a trade association for the promotion and development of Modbus protocol.
Modbus Plus.
Despite the name, Modbus Plus is not a variant of Modbus. It is a different protocol, involving token passing.
It is a proprietary specification of Schneider Electric, though it is unpublished rather than patented. It is normally implemented using a custom chipset available only to partners of Schneider. 