Modbus

Modbus is a serial communications protocol originally published by Modicon (now Schneider Electric) in 1979 for use with its programmable logic controllers (PLCs). Simple and robust, it has since become a de facto standard communication protocol, and it is now a commonly available means of connecting industrial electronic devices.[1] The main reasons for the use of Modbus in the industrial environment are:

Modbus enables communication among many devices connected to the same network, for example a system that measures temperature and humidity and communicates the results to a computer. Modbus is often used to connect a supervisory computer with a remote terminal unit (RTU) in supervisory control and data acquisition (SCADA) systems. Many of the data types are named from its use in driving relays: a single-bit physical output is called a coil, and a single-bit physical input is called a discrete input or a contact.

The development and update of Modbus protocols has been managed by the Modbus Organization[2] since April 2004, when Schneider Electric transferred rights to that organization.[3] The Modbus Organization is an association of users and suppliers of Modbus compliant devices that seeks to drive the adoption and evolution of Modbus.[4]

Modbus object types

The following is a table of object types provided by a modbus slave device to a modbus master device:

Object Type Access Size
Coil Read-Write 1-bit
Discrete Input Read-Only 1-bit
Input Register Read-Only 16-bits
Holding Register Read-Write 16-bits

Protocol versions

Versions of the Modbus protocol exist for serial port and for Ethernet and other protocols that support the Internet protocol suite. There are many variants of Modbus protocols:

Data model and function calls are identical for the first 4 variants of protocols; only the encapsulation is different. However the variants are not interoperable as are the frame formats.

Communication and devices

Each device intended to communicate using Modbus is given a unique address. In serial and MB+ networks, only the node assigned as the Master may initiate a command. On Ethernet, any device can send out a Modbus command, although usually only one master device does so. A Modbus command contains the Modbus address of the device it is intended for (1 to 247). Only the intended device will act on the command, even though other devices might receive it (an exception is specific broadcastable commands sent to node 0 which are acted on but not acknowledged). All Modbus commands contain checksum information, to allow the recipient to detect transmission errors. The basic Modbus commands can instruct an RTU to change the value in one of its registers, control or read an I/O port, and command the device to send back one or more values contained in its registers.

There are many modems and gateways that support Modbus, as it is a very simple protocol and often copied. Some of them were specifically designed for this protocol. Different implementations use wireline, wireless communication, such as in the ISM band, and even Short Message Service (SMS) or General Packet Radio Service (GPRS). One of the more common designs of wireless networks makes use of mesh networking. Typical problems that designers have to overcome include high latency and timing issues.

Frame format

A Modbus frame is composed of an Application Data Unit (ADU) which encloses a Protocol Data Unit (PDU):[9]

All Modbus variants choose one of the following frame formats.[1]

Modbus RTU frame format (primarily used on 8-bit asynchronous lines like EIA-485)
Name Length (bits) Function
Start 28 At least  3 1⁄2 character times of silence (mark condition)
Address 8 Station address
Function 8 Indicates the function code; e.g., read coils/holding registers
Data n × 8 Data + length will be filled depending on the message type
CRC 16 Cyclic redundancy check
End 28 At least  3 1⁄2 character times of silence between frames

Note about the CRC:

Modbus ASCII frame format (primarily used on 7- or 8-bit asynchronous serial lines)
Name Length (bytes) Function
Start 1 Starts with colon : (ASCII hex value is 0x3a)
Address 2 Station address
Function 2 Indicates the function codes like read coils / inputs
Data n × 2 Data + length will be filled depending on the message type
LRC 2 Checksum (Longitudinal redundancy check)
End 2 Carriage return – line feed (CR/LF) pair (ASCII values of 0x0d & 0x0a)

Address, function, data, and LRC are all capital hexadecimal readable pairs of characters representing 8-bit values (0–255). For example, 122 (7x16+10) will be represented as 7A.
LRC is calculated as the sum of 8-bit values, negated (two's complement) and encoded as an 8-bit value. Example: if address, function, and data encode as 247, 3, 19, 137, 0, and 10, their sum is 416. Two's complement (-416) trimmed to 8-bit is 96 (e.g. 256x2-416) which will be represented as 60 in hexadecimal. Hence the following frame :F7031389000A60<CR><LF>

Modbus TCP frame format (primarily used on Ethernet networks)
Name Length (bytes) Function
Transaction identifier 2 For synchronization between messages of server & client
Protocol identifier 2 Zero for Modbus/TCP
Length field 2 Number of remaining bytes in this frame
Unit identifier 1 Slave address (255 if not used)
Function code 1 Function codes as in other variants
Data bytes n Data as response or commands

Unit identifier is used with Modbus/TCP devices that are composites of several Modbus devices, e.g. on Modbus/TCP to Modbus RTU gateways. In such case, the unit identifier tells the Slave Address of the device behind the gateway. Natively Modbus/TCP-capable devices usually ignore the Unit Identifier.

The byte order for values in Modbus data frames is big-endian (MSB, Most Significant Byte of a value received first).

Supported function codes

The various reading, writing and other operations are categorised as follows.[10] The most primitive reads and writes are shown in bold. A number of sources use alternative terminology, for example Force Single Coil where the standard uses Write Single Coil.[11]
Prominent entities within a Modbus slave are:

Modbus function codes
Function typeFunction nameFunction code
Data AccessBit accessPhysical Discrete InputsRead Discrete Inputs2
Internal Bits or Physical CoilsRead Coils1
Write Single Coil5
Write Multiple Coils15
16-bit accessPhysical Input RegistersRead Input Registers4
Internal Registers or Physical Output RegistersRead Multiple Holding Registers3
Write Single Holding Register6
Write Multiple Holding Registers16
Read/Write Multiple Registers23
Mask Write Register22
Read FIFO Queue24
File Record AccessRead File Record20
Write File Record21
DiagnosticsRead Exception Status7
Diagnostic8
Get Com Event Counter11
Get Com Event Log12
Report Slave ID17
Read Device Identification43
OtherEncapsulated Interface Transport43

Format of data of requests and responses for main function codes

Requests and responses follow frame formats described above. This section gives details of data formats of most used function codes.

Function code 1 (read coils) and function code 2 (read discrete inputs)

Request:

Normal response:

Value of each coil/discrete input is binary (0 for off, 1 for on). First requested coil/discrete input is stored as least significant bit of first byte in reply.
If number of coils/discrete inputs is not a multiple of 8, most significant bit(s) of last byte will be stuffed with zeros.
For example, if eleven coils are requested, two bytes of values are needed. Suppose states of those successive coils are on, off, on, off, off, on, on, on, off, on, on, then the response will be 02 E5 06 in hexadecimal.

Function code 5 (force/write single coil)

Request:

Normal response: same as request.

Function code 15 (force/write multiple coils)

Request:

Value of each coil is binary (0 for off, 1 for on). First requested coil is stored as least significant bit of first byte in request.
If number of coils is not a multiple of 8, most significant bit(s) of last byte should be stuffed with zeros. See example for function codes 1 and 2.

Normal response:

Function code 4 (read input registers) and function code 3 (read holding registers)

Request:

Normal response:

Because the number of bytes for register values is 8-bit wide, only 127 registers can be read at once.

Function code 6 (preset/write single holding register)

Request:

Normal response: same as request.

Function code 16 (preset/write multiple holding registers)

Request:

Because register values are 2-bytes wide and only 127 bytes worth of values can be sent, only 63 holding registers can be preset/written at once.

Normal response:

Exception responses

For a normal response, slave repeats the function code. Should a slave want to report an error, it will reply with the requested function code plus 128 (3 becomes 131 or 83 in hexadecimal), and will only include one byte of data, known as the exception code.

Main Modbus exception codes

Code Text Details
1 Illegal Function Function code received in the query is not recognized or allowed by slave
2 Illegal Data Address Data address of some or all the required entities are not allowed or do not exist in slave
3 Illegal Data Value Value is not accepted by slave
4 Slave Device Failure Unrecoverable error occurred while slave was attempting to perform requested action
5 Acknowledge Slave has accepted request and is processing it, but a long duration of time is required. This response is returned to prevent a timeout error from occurring in the master. Master can next issue a Poll Program Complete message to determine if processing is completed
6 Slave Device Busy Slave is engaged in processing a long-duration command. Master should retry later
7 Negative Acknowledge Slave cannot perform the programming functions. Master should request diagnostic or error information from slave
8 Memory Parity Error Slave detected a parity error in memory. Master can retry the request, but service may be required on the slave device
10 Gateway Path Unavailable Specialized for Modbus gateways. Indicates a misconfigured gateway
11 Gateway Target Device Failed to Respond Specialized for Modbus gateways. Sent when slave fails to respond

Coil, discrete input, input register, holding register numbers and addresses

Some conventions govern how access to Modbus entities (coils, discrete inputs, input registers, holding registers) are referenced.
It is important to make a distinction between entity number and entity address:

In the traditional standard, numbers for those entities start with a digit, followed by a number of four digits in range 1–9,999:

This translates into addresses between 0 and 9,998 in data frames.
For example, in order to read holding registers starting at number 40001, corresponding address in the data frame will be 0 with a function code of 3 (as seen above). For holding registers starting at number 40100, address will be 99. Etc.
This limits the number of addresses to 9,999 for each entity. A de facto referencing extends this to the maximum of 65,536.[12]
It simply consists of adding one digit to the previous list:

When using the extended referencing, all number references must be exactly six digits. This avoids confusion between coils and other entities. For example, to know the difference between holding register #40001 and coil #40001, if coil #40001 is the target, it must appear as #040001.

JBUS mapping

Another de facto protocol tightly related with Modbus appeared after it and was defined by PLC brand April Automates, resulting of a collaborative effort of French companies Renault Automation and Merlin Gerin et Cie in 1985:JBUS. Differences between Modbus and JBUS at that time (number of entities, slave stations) are now irrelevant as this protocol almost disappeared with April PLC series which AEG Schneider Automation bought in 1994 and then made them obsolete. However the name JBUS survived to some extent.

JBUS supports function codes 1, 2, 3, 4, 5, 6, 15, and 16 and thus all the entities described above. However numbering is different with JBUS:

Implementations

Almost all implementations have variations from the official standard. Different varieties might not communicate correctly between equipment of different suppliers. Some of the most common variations are:

Limitations

Trade group

Modbus Organization, Inc. is a trade association for the promotion and development of Modbus protocol.[2]

Modbus Plus

Despite the name, Modbus Plus[14] is not a variant of Modbus. It is a different protocol, involving token passing.

It is a proprietary specification of Schneider Electric, though it is unpublished rather than patented. It is normally implemented using a custom chipset available only to partners of Schneider.

References

  1. 1 2 Drury, Bill (2009). Control Techniques Drives and Controls Handbook (PDF) (2nd ed.). Institution of Engineering and Technology. pp. 508–. (subscription required (help)).
  2. 1 2 "Modbus home page". Modbus. Modbus Organization, Inc. Retrieved 2 August 2013.
  3. ↑ "Modbus FAQ". Modbus. Modbus Organization, Inc. Retrieved 1 November 2012.
  4. ↑ "About Modbus Organization". Modbus. Modbus Organization, Inc. Retrieved 8 November 2012.
  5. ↑ Modbus Messaging on TCP/IP Implementation Guide V1.0b, s3.1.3
  6. ↑ Remote Modbus Network Monitoring
  7. ↑ Java implementation
  8. ↑ http://www.simplymodbus.ca/Enron.htm
  9. ↑ "Modbus Messaging On TCP/IP Implementation Guide" (PDF). Modbus Organization. Modbus-IDA.
  10. ↑ "Modbus Application Protocol V1.1b3" (PDF). Modbus. Modbus Organization, Inc. Retrieved 2 August 2013.
  11. ↑ Clarke, Gordon; Reynders, Deon (2004). Practical Modern Scada Protocols: Dnp3, 60870.5 and Related Systems. Newnes. pp. 47–51. ISBN 0-7506-5799-5.
  12. ↑ "Modbus 101 - Introduction to Modbus". Control Solutions, Inc.
  13. ↑ Palmer; Shenoi, Sujeet, eds. (23–25 March 2009). Critical Infrastructure Protection III. Third IFIP WG 11. 10 International Conference. Hanover, New Hampshire: Springer. p. 87. ISBN 3-642-04797-1.
  14. ↑ "Modbus Plus - Modbus Plus Network - Products overview - Schneider Electric United States". Schneider-electric.com. Retrieved 2014-01-03.

External links

Specification
Other
This article is issued from Wikipedia - version of the 11/24/2016. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.