modbus info
TRANSCRIPT
MODBUS PROTOCOL
Introduction
MODBUS Serial Line protocol is a Master-Slave protocol. Thisprotocol takes place at level 2 of the OSI model.
At the physical level, MODBUS over Serial Line systems may use different physical interfaces (RS485, RS232). TIA/EIA-485 (RS485)
Two-Wire interface is the most common. As an add-on option, RS485 Four-Wire interface may also be implemented. A TIA/EIA-232-E (RS232) serial interface may also be used as an interface, when only short point to point communication is required.
MODBUS application layer messaging protocol, positioned at level 7 of the OSI model, provides client/server communication betweendevices connected on buses or networks. On MODBUS serial line the client role is provided by the Master of the serial bus and theSlaves nodes act as servers.
PLC HMI I/O PLC I/O
Device
PLC
Device
I/O
I/O
Gateway Gateway
MODBUS Communication
MODBUS ON TCP/IP
MO
DB
US
ON
RS
232
MO
DB
US
ON
RS
485
Drive
Example of MODBUS Network Architecture
• Only one master (at the same time) is connected to the bus, and one or several (247 maximum number) slaves nodes are also connected to the same serial bus. A MODBUS communication is always initiated by the master. The slave nodes will never transmit data without receiving a request from the master node. The slave nodes will never communicate with each other. The master node initiates only one MODBUS transaction at the same time.
• The master node issues a MODBUS request to the slave nodes in two modes :
• unicast mode, the master addresses an individual slave. After receiving and processing the request, the slave returns a message (a 'reply') to the master. In that mode, a MODBUS transaction consists of 2 messages : a request from the master, and a reply from the slave. Each slave must have an unique address (from 1 to 247) so that it can be addressed independently from other nodes.
• broadcast mode, the master can send a request to all slaves. No response is returned to broadcast requests sent by the master. The broadcast requests are necessarily writing commands. All devices must accept the broadcast for writing function. The address 0 is reserved to identify a broadcast exchange.
Slave 1Slave 2Slave 3
Master
Slave 1Slave 2Slave 3
Request
Reply
Request
Unicast Mode
Broadcast Mode
Master
MODBUS Addressing Rules
0 – Broadcast address
From 1 to 247 – Slave individual addresses
From 248 to 255 – Reserved
The MODBUS Master node has no specific address, only the slave nodes must have an address. This address must be unique on a MODBUS serial bus.
MODBUS Frame Description
Function Code Data
MODBUS PDU
MODBUS Protocol Data Unit
Function Code Data
MODBUS PDU
MODBUS Application Data Unit
Address Field Checksum
MODBUS ADU
Two Serial Transmission Modes: The RTU mode and the ASCII mode.
The transmission mode (and serial port parameters) must be the same for all devices on a MODBUS Serial Line.
All devices must implement the RTU Mode. The ASCII transmission mode is an option.
RTU Mode:
The format ( 11 bits ) for each byte in RTU mode is :Coding System: 8–bit binaryBits per Byte: 1 start bit8 data bits, least significant bit sent first1 bit for parity completion1 stop bit
Start 1 2 3 4 5 6 7 8 Par/Stop1 Stop2
Frame Description:
RTU Message Frame
The maximum size of a MODBUS RTU frame is 256 bytes.
MODBUS Message RTU Framing
<= 1.5 Char
SlaveAddress
FunctionCode
Data CRC
1 byte 1 byte 0 up to 252 byte (s) 2 bytes
Start Address Function Data CRC End
>=3.5Char
8 Bits 8 Bits N x 8 Bits 16 Bits>=3.5Char
Byte 1 Byte 2 Byte 3 Byte 4
ASCII Transmission Mode:When devices are setup to communicate on a MODBUS serial line using ASCII (American Standard Code for Information Interchange) mode, each 8–bit byte in a message is sent as two ASCII characters. This mode is used when the physical communication link or the capabilities of the device does not allow the conformance with RTU mode requirements regarding timersmanagement.Remark : this mode is less efficient than RTU since each byte needs two characters.
Example : The byte 0X5B is encoded as two characters : 0x35 and 0x42 ( 0x35 ="5", and 0x42 ="B" in ASCII ).
The format ( 10 bits ) for each byte in ASCII mode is :Coding System: Hexadecimal, ASCII characters 0–9, A–F
One hexadecimal character contains 4-bits of data within each ASCII character of the messageBits per Byte: 1 start bit
7 data bits, least significant bit sent first1 bit for parity completion1 stop bit
Start 1 2 3 4 5 6 7 Par/Stop1 Stop2
MODBUS Message ASCII Framing:A MODBUS message is placed by the transmitting device into a frame that has a known beginning and ending point. This allows devices that receive a new frame to begin at the start of the message, and to know when the message is completed.
ASCII Message Frame
ASCII Inter Byte Time Out:Intervals of up to one second may elapse between characters within the message. Unless the user has configured a longer timeout, an interval greater than 1 second means an error has occurred. Some Wide-Area-Network application may require a timeout in the 4 to 5 second range.
<= 1 Sec
Start Address Function Data LRC End
1 Char:
2 Chars 2 Chars 0 up to 2x252 Char (s) 2 Chars2 CharsCR, LF
Byte 1 Byte 2 Byte 3 Byte 4
Response Time Out:
When a unicast request is sent to a slave, the master goes into "Waiting for reply" state, and a “Response Time-out” is started. It prevents the Master from staying indefinitely in "Waiting for reply" state. Value of the Response time-out is application dependant.
If no reply is received, the Response time-out expires, and an error is generated. Then the Master goes into "Idle" state, enabling a retry of the request. The maximum number of retries depends on the master set-up.
MODBUS Parameter Configuration in AxisLog:
MODBUS Data Types:
Parameter Type Address Range
Coils (Read / Write type Bits) 000001 - 065535
Discrete Inputs (Read only type Bits) 100001 - 165535
Holding Registers (Read / Write type Words) 400001 - 465535
Input Registers (Read only type Words) 300001 - 365535
Supported Function Codes by AxisLog:
Bit Access
Read Coils 01
Read Discrete Inputs 02
Write Single Coil 05
Write Multiple Coils 15
Read Holding Register 03
Read Input Register 04
Write Single Register 06
Write Multiple Registers 16
Request and Response formats related to Function codes:
Read Coils:
RequestFunction code 1 Byte 0x01Starting Address 2 Bytes 0x0000 to 0xFFFFQuantity of coils 2 Bytes 1 to 2000 (0x7D0)
ResponseFunction code 1 Byte 0x01Byte count 1 Byte N*Coil Status n Byte n = N or N+1*N = Quantity of Outputs / 8, if the remainder is different of 0 N = N+1⇒
ErrorFunction code 1 Byte Function code + 0x80Exception code 1 Byte 01 or 02 or 03 or 04
Exception Code Meaning01 Function Code not Valid02 Data Address not Valid03 Data Value not Valid
Request and Response formats related to Function codes:
Read Discrete Inputs:
RequestFunction code 1 Byte 0x02Starting Address 2 Bytes 0x0000 to 0xFFFFQuantity of Inputs 2 Bytes 1 to 2000 (0x7D0)
ResponseFunction code 1 Byte 0x02Byte count 1 Byte N*Input Status N* x 1 Byte*N = Quantity of Inputs / 8 if the remainder is different of 0 N = N+1⇒
ErrorError code 1 Byte 0x82Exception code 1 Byte 01 or 02 or 03 or 04
Request and Response formats related to Function codes:
Read Holding Registers:
RequestFunction code 1 Byte 0x03Starting Address 2 Bytes 0x0000 to 0xFFFFQuantity of Registers 2 Bytes 1 to 125 (0x7D)
ResponseFunction code 1 Byte 0x03Byte count 1 Byte 2 x N*Register value N* x 2 Bytes*N = Quantity of Registers
ErrorError code 1 Byte 0x83Exception code 1 Byte 01 or 02 or 03 or 04
Request and Response formats related to Function codes:
Read Input Registers:
RequestFunction code 1 Byte 0x04Starting Address 2 Bytes 0x0000 to 0xFFFFQuantity of Input Registers 2 Bytes 0x0001 to 0x007D
ResponseFunction code 1 Byte 0x04Byte count 1 Byte 2 x N*Input Registers N* x 2 Bytes*N = Quantity of Input Registers
ErrorError code 1 Byte 0x84Exception code 1 Byte 01 or 02 or 03 or 04
Request and Response formats related to Function codes:
Write Single Coil:
RequestFunction code 1 Byte 0x05Output Address 2 Bytes 0x0000 to 0xFFFFOutput Value 2 Bytes 0x0000 or 0xFF00
ResponseFunction code 1 Byte 0x05Output Address 2 Bytes 0x0000 to 0xFFFFOutput Value 2 Bytes 0x0000 or 0xFF00
ErrorError code 1 Byte 0x85Exception code 1 Byte 01 or 02 or 03 or 04
Request and Response formats related to Function codes:
Write Single Register:
RequestFunction code 1 Byte 0x06Register Address 2 Bytes 0x0000 to 0xFFFFRegister Value 2 Bytes 0x0000 to 0xFFFF
ResponseFunction code 1 Byte 0x06Register Address 2 Bytes 0x0000 to 0xFFFFRegister Value 2 Bytes 0x0000 to 0xFFFF
ErrorError code 1 Byte 0x86Exception code 1 Byte 01 or 02 or 03 or 04
Request and Response formats related to Function codes:
Write Multiple Coils:
RequestFunction code 1 Byte 0x0FStarting Address 2 Bytes 0x0000 to 0xFFFFQuantity of Outputs 2 Bytes 0x0001 to 0x07B0Byte Count 1 Byte N*Outputs Value N* x 1 Byte*N = Quantity of Outputs / 8, if the remainder is different of 0 N = N+1⇒
ResponseFunction code 1 Byte 0x0FStarting Address 2 Bytes 0x0000 to 0xFFFFQuantity of Outputs 2 Bytes 0x0001 to 0x07B0
ErrorError code 1 Byte 0x8FException code 1 Byte 01 or 02 or 03 or 04
Request and Response formats related to Function codes:
Write Multiple Registers:
RequestFunction code 1 Byte 0x10Starting Address 2 Bytes 0x0000 to 0xFFFFQuantity of Registers 2 Bytes 0x0001 to 0x007BByte Count 1 Byte 2 x N*Registers Value N* x 2 Bytes value*N = Quantity of Registers
ResponseFunction code 1 Byte 0x10Starting Address 2 Bytes 0x0000 to 0xFFFFQuantity of Registers 2 Bytes 1 to 123 (0x7B)
ErrorError code 1 Byte 0x90Exception code 1 Byte 01 or 02 or 03 or 04
Data types supported by AxisLogger:
Sr. No. AxisLogger Data type Meaning
1 Boolean Binary 1 Bit
2 Unsigned Int 2 Bytes (unsigned short)
3 Int 2 Bytes (short)
4 LongR1R2 4 Bytes (long) Lower Word first, Higher Word next
5 LongR2R1 4 Bytes (long) Higher Word first, Lower Word next
6 DWORDR1R2 4 Bytes (unsigned long) Lower Word first, Higher Word next
7 DWORDR2R1 4 Bytes (unsigned long) Higher Word first, Lower Word next
8 FloatR1R2 4 Bytes (float) Lower Word first, Higher Word next
9 FloatR2R1 4 Bytes (float) Higher Word first, Lower Word next
10 2BytesBCD 2 Bytes (BCD)
11 4BytesBCDR1R2 4 Bytes (BCD) Lower Word first, Higher Word next
12 4BytesBCDR2R1 4 Bytes (BCD) Higher Word first, Lower Word next
13 Custom1Byte 1 Byte from given offset in Block
14 Custom2Bytes 2 Bytes from given offset in Block
15 Custom3Bytes 3 Bytes from given offset in Block
16 Custom4Bytes 4 Bytes from given offset in Block
Tag Configuration in AxisLogger:
Analog Tag Configuration:
DigiTag Configuration:
MASTER
SLAVE
Holding Regs
Input Regs
Coils
Discrete Inputs
Request
Response
Request to read 1 Holding Register 400001
Start Slave ID Function CRC H End>=3.5Char
01 03>=3.5Char
CRC L
StartAddress
High
00
StartAddress
Low
00
StartAddress
High
00
StartAddress
Low
01
Example
Start Slave ID Function CRC H End>=3.5Char
01 01>=3.5Char
CRC L
NoOf
Bytes
02
DataByte 1
0x12
DataByte 2
0x34
Response Data Value is 0x1234
<=1.5Sec
THANK YOU