DS-CLS9-FRS4_DS-CLS9-FRS4-01_MODBUS Protocol Manual
59Pages

MODBUS application protocol specification Technical Manual MODBUS PROTOCOL

Click to return to table of contents [MODBUS APPLICATION PROTOCOL SPECIFICATION] 1. 2. 3. 4.

MODBUS Application Protocol Specification V1.1b3 [MODBUS APPLICATION PROTOCOL SPECIFICATION] 1. Introduction 1.1 Scope of this document MODBUS is an application layer messaging protocol, positioned at level 7 of the OSI model, which provides client/server communication between devices connected on different types of buses or networks. The industry’s serial de facto standard since 1979, MODBUS continues to enable millions of automation devices to communicate. Today, support for the simple and elegant structure of MODBUS continues to grow. The Internet community can access MODBUS at a...

MODBUS Application Protocol Specification V1.1b3 MAC Media Access Control MB MODBUS Protocol MBAP MODBUS Application Protocol PDU Protocol Data Unit PLC Programmable Logic Controller TCP Transmission Control Protocol The MODBUS protocol allows an easy communication within all types of network architectures. Figure 2: Example of MODBUS Network Architecture Every type of devices (PLC, HMI, Control Panel, Driver, Motion control, I/O Device…) can use MODBUS protocol to initiate a remote operation. The same communication can be done as well on serial line as on an Ethernet TCP/IP networks....

MODBUS Application Protocol Specification V1.1b3 Figure 3: General MODBUS frame The MODBUS application data unit is built by the client that initiates a MODBUS transaction. The function indicates to the server what kind of action to perform. The MODBUS application protocol establishes the format of a request initiated by a client. The function code field of a MODBUS data unit is coded in one byte. Valid codes are in the range of 1 ... 255 decimal (the range 128 – 255 is reserved and used for exception responses). When a message is sent f rom a Client to a Server device the function code...

MODBUS Application Protocol Specification V1.1b3 Figure 5: MODBUS transaction (exception response)  Note: It is desirable to manage a time out in order not to indefinitely wait for an answer which will perhaps never arrive. The size of the MODBUS PDU is limited by the size constraint inherited from the first MODBUS implementation on Serial Line network (max. RS485 ADU = 256 bytes). Therefore: MODBUS PDU for serial line communication = 256 - Server address (1 byte) - CRC (2 bytes) = 253 bytes. Consequently: RS232 / RS485 ADU = 253 bytes + Server address (1 byte) + CRC (2 bytes) = 256 bytes....

MODBUS Application Protocol Specification V1.1b3 MODBUS uses a ‘big-Endian’ representation for addresses and data items. This means that when a numerical quantity larger than a single byte is transmitted, the most significant byte is sent first. So for example Register size value 16 - bits 0x1234  Note: For more details, see [1] . the first byte sent is 0x12 then 0x34 4.3 MODBUS Data model MODBUS bases its data model on a series of tables that have distinguishing characteristics. The four primary tables are: Primary tables Object type Discretes Input This type of data can be provided by an...

MODBUS Application Protocol Specification V1.1b3 Figure 6 MODBUS Data Model with separate block Example 2: Device having only 1 block In this example, the device has only 1 data block. The same data can be reached via several MODBUS functions, either via a 16 bit access or via an access bit. Figure 7 MODBUS Data Model with only 1 block page│8

MODBUS Application Protocol Specification V1.1b3 4.4 MODBUS Addressing model The MODBUS application protocol defines precisely PDU addressing rules. In a MODBUS PDU each data is addressed from 0 to 65535. It also defines clearly a MODBUS data model composed of 4 blocks that comprises several elements numbered from 1 to n. In the MODBUS data Model each element within a data block is numbered from 1 to n. Afterwards the MODBUS data model has to be bound to the device application ( IEC-61131 object, or other application model). The pre-mapping between the MODBUS data model and the device...

MODBUS Application Protocol Specification V1.1b3 4.5 Define MODBUS Transaction The following state diagram describes the generic processing of a MODBUS transaction in server side. Figure 9 MODBUS Transaction state diagram Once the request has been processed by a server, a MODBUS response using the adequate MODBUS server transaction is built. Depending on the result of the processing two types of response are built :  A positive MODBUS response :   the response function code = the request function code A MODBUS Exception response ( see section 7 ):  the objective is to provide to the...

MODBUS Application Protocol Specification V1.1b3 5. Function Code Categories There are three categories of MODBUS Functions codes. They are : Public Function Codes  Are well defined function codes ,  validated by the MODBUS.org community, publicly documented have available conformance test, includes both defined public assigned function codes as well as unassigned function codes reserved for future use. User-Defined Function Codes  there are two ranges of user-defined function codes, i.e. 65 to 72 and from 100 to 110 decimal.  user can select and implement a function code that is not...

MODBUS Application Protocol Specification V1.1b3 5.1 Public Function Code Definition 6. Function codes descriptions 6.1 01 (0x01) Read Coils This function code is used to read from 1 to 2000 contiguous status of coils in a remote device. The Request PDU specifies the starting address, i.e. the address of the first coil specified, and the number of coils. In the PDU Coils are addressed starting at zero. Therefore coils numbered 1-16 are addressed as 0-15. The coils in the response message are packed as one coil per bit of the data field. Status is indicated as 1= ON and 0= OFF. The LSB of...

MODBUS Application Protocol Specification V1.1b3 Request Function code Starting Address Function code Byte count Coil Status *N = Quantity of Outputs / 8, if the remainder is different of 0 Error Function code Exception code Here is an example of a request to read discrete outputs 20–38: Request Field Name Field Name Byte Count The status of outputs 27–20 is shown as the byte value CD hex, or binary 1100 1101. Output 27 is the MSB of this byte, and output 20 is the LSB. By convention, bits within a byte are shown with the MSB to the left, and the LSB to the right. Thus the outputs in the...