What is Modbus and how does it work? | Schneider Electric, USA (2023)

This document describes how Modbus works and what needs to be done for a correct installation.

Production line:
All product lines

All serial numbers

to install


What is Modbus?

Modbus is a serial communication protocol developed by Modicon and published by Modicon® in 1979 for use with programmable logic controllers (PLC). Simply put, it is a method used to transfer information between electronic devices via serial links. The device that requests information is called a Modbus client and the devices that provide the information are called Modbus servers. In a standard Modbus network, there is one client and up to 247 servers, each with a unique server address from 1 to 247. The client can also write information to the servers.

The official Modbus specification can be found athttp://www.modbus.org/

What is it for?

Modbus is an open protocol, which means that manufacturers can integrate it into their equipment free of charge, without incurring any licensing fees. It has become the industry standard communication protocol and is currently the most widely available means of interconnecting industrial electronic devices. It is widely used by many manufacturers in many industries. Modbus is typically used to send signals from instrumentation and control equipment back to a master controller or data collection system, such as a system that measures temperature and humidity, and transfers the results to a computer. Modbus is commonly used to connect a supervisory computer to an external terminal unit (RTU) in SCADA (supervision and data acquisition) systems. There are versions of the Modbus protocol for serial lines (Modbus RTU and Modbus ASCII) and for Ethernet networks (Modbus TCP).

How it's working?

Modbus is sent between devices via serial lines. The simplest configuration would be a single serial cable connecting the serial ports of two devices, client and server.

What is Modbus and how does it work? | Schneider Electric, USA (1)

Data is sent as a string of ones and zeros called bits. Each bit is sent as a voltage. Zero is sent as positive voltage and ones as negative voltage. Bits are sent very quickly. Typical baud rate is 9600 baud (bits per second).

What is hexadecimal?

When troubleshooting, it can be helpful to see what raw data is actually being transferred. Long strings of 0s and 1s are hard to read, so the bits are concatenated and represented in hexadecimal. Each 4-bit block is represented by one of the sixteen characters from 0 to F.

What is Modbus and how does it work? | Schneider Electric, USA (2)

Each block of 8 bits (called a byte) is represented by one of the 256 character pairs from 00 to FF.

How is data stored in the Modbus standard?

The information is stored in four different tables on the server device. Two tables hold discrete on/off values ​​(coils) and two hold numeric values ​​(registers). The coils and registers have a read-only table and a read-write table. Each table has 9999 values. Each coil or contact has 1 bit and is assigned a data address ranging from 0000 to 270E. Each register consists of 1 word = 16 bits = 2 bytes and also has a data address ranging from 0000 to 270E.

What is Modbus and how does it work? | Schneider Electric, USA (3)

Scrolling/logging numbers can be thought of as location names as they do not appear in actual messages. Data addresses are used in messages. For example, the first property register number 40001 has data address 0000. The difference between the two values ​​ismovement. Each table has a different offset. 1, 10001, 30001 and 40001.

What is the server ID?

Each server on the network is assigned a unique address from 1 to 247. When a client requests data, the first byte sent is the address of the server. This way, after the first byte, each server knows whether to ignore the message or not.

What is the function code?

The second byte sent by the client is the function code. This number tells the server which table to access and whether to read or write to the table.

What is Modbus and how does it work? | Schneider Electric, USA (4)

What is a CRC?

CRC stands for Cyclic Redundancy Check. These are two bytes added to the end of each Modbus message for error detection. Each byte of the message is used to calculate the CRC. The receiving device also calculates the CRC and compares it with the CRC of the sending device. If even one bit in the message is received incorrectly, the CRC will be different and an error will occur. .

What are the Modbus command and response formats?

What is Modbus and how does it work? | Schneider Electric, USA (5)

What are data types?

The FC03 example shows that register 40108 contains AE41, which is converted to 16 bits. 1010 1110 0100 0001 Great! But what does it mean? Well, that could mean several things. Register 40108 can be defined as one of the following 16-bit data types:

AA 16-bit unsigned integer(integer from 0 to 65535) register 40108 contains AE41 = 44.609 (hexadecimal to decimal conversion)

AA 16-bit signed integer(integer between -32768 and 32767) AE41 = -20.927 (convert from hexadecimal to decimal by subtracting 65536 if greater than 32767)

Atwo-character ASCII character string(2 letters) AE41 = ® A

Adiscrete on/off value(This works the same as 16-bit integers with a value of 0 or 1. Hexadecimal data is 0000 or 0001) Register 40108 can also be combined with

40109 to create one of these 32-bit data types:

AA 32-bit unsigned integer(a number from 0 to 4,294,967,295) 40108.40109 = AE41 5652 = 2,923,517,522

AA 32-bit signed integer(number from -2 147 483 648 to 2 147 483 647) AE41 5652 = -1 371 449 774

AIEEE 32-bit double-precision floating point number. This is a mathematical formula that can represent any real number (a number with decimal places) in 32 bits with a precision of about seven digits. AE41 5652 = -4.395978 E-11 Here is an IEEE floating point calculator spreadsheet for 4 bytes or 2 words. To download a copy, right-click and select Save Target As...

AA four-character ASCII string(4 letters typed) AE41 5652 = ® A VR R You can combine multiple registers into longer ASCII sequences. Each register is used to store two ASCII characters (two bytes).

What is byte and word order?

The Modbus specification does not precisely define how data is stored in registers. Therefore, some manufacturers have implemented the Modbus protocol in their equipment to store and transmit the first byte followed by the lower byte. (AE before 41). Alternatively, others may write and send the lower byte first (41 before AE). Similarly, when registers are combined to represent 32-bit data types, some devices store the upper 16 bits (highest word) in the first register and the remaining lower word in the second (AE41 before 5652), while others store the reverse. (5652). before AE41) It doesn't matter what order the bytes or words are sent as long as the receiving device knows how to expect it. For example, if the number 29,235,175,522 was sent as an unsigned 32-bit integer, it can be arranged in one of four ways.

AE41 5652 - high byte, first high word

5652 AE41 - high byte, low first word

41AE 5256 First high word in low byte

5256 41AE first low byte first low word

What is a Modbus card?

The Modbus map is simply a list of individual server devices that defines what data (pressure or temperature readings, for example) are

- where the data is stored (which tables and data addresses)

- data storage method (data types, byte and word order)

Some devices are built with a fixed map defined by the manufacturer. While other devices allow the operator to configure or program a custom card to suit his needs.

What is the difference between Modbus ASCII and Modbus RTU?

Modbus RTU and Modbus ASCII communicate using the same protocol. The only difference is that the bytes sent over the wire are represented as binary in RTU and as readable ASCII in Modbus RTU. With regard to the RTU, note that the RTU message does not have a Start_Text indication. During communication, the recipient uses the "quiet" time to determine the beginning of a new message. ASCII has a text start token. Binary messages are shorter than ASCII and therefore can theoretically be sent/received faster. You can be happy with an update rate of around 100ms in your HMI/SCADA and you can choose any communication you want.

- it is possible to use RTU
- use ASCII if RTU causes timeout problems in WinNT or if you are using slow communication media like 300 bps or dial-up modems. Most Modbus OPC servers support both ASCII and RTU communication.

What are extended register addresses?

Since the register range of the analog output is from 40001 to 49999, it means that there can be no more than 9999 registers. While this is usually sufficient for most applications, there are cases where more registers would be useful. Registers 40001 to 49999 correspond to data addresses 0000 to 270E. Using the remaining data addresses 270F to FFFF, more than six times as many registers are available, for a total of 65536. This would correspond to register numbers 40001 to 105536. Many Modbus software drivers (for client computers) are written with limits of 40001 to 49999, and there are no access to extended registers on server devices. Many server devices do not support directories that use extended registers. On the other hand, some server devices support these registers and some client programs can access them, especially if custom software has been written.

How does 2-byte server addressing work?

Since a single byte is usually used to specify a server address, and each server in a network requires a unique address, the number of servers in a network is limited to 256. The limit specified in the Modbus specification is even lower: 247. If you exceed this limit, you can change the protocol, to use two bytes in the address. The client and servers should support this change. Double-byte addressing increases the limit on the number of servers in the network to 65535. Simply Modbus software uses 1-byte addressing by default. When an address greater than 255 is entered, the software automatically switches to 2-byte addressing and remains in this mode for all addresses until 2-byte addressing is manually disabled.

How can you upload events and historical data?

Enron Modbus includes commands to transfer events and historical data.

What is Enron Modbus?

Enron Modbus is a modification of the standard Modicon Modbus communication protocol developed by Enron Corporation.

See Enron Modbus for details.

Released for:Schneider Electric SAD


What is Modbus and how does it work? | Schneider Electric, USA? ›

Modbus is a communication protocol developed by Modicon systems. In simple terms, it is a method used for transmitting information over serial lines between electronic devices. The device requesting the information is called the Modbus Master and the devices supplying information are Modbus Slaves.

What is Modbus in electrical? ›

Modbus is typically used to transmit signals from instrumentation and control devices back to a main controller or data gathering system, for example a system that measures temperature and humidity and communicates the results to a computer.

What is Modbus for dummies? ›

Modbus function codes

Modbus defines four separate data blocks, each with addresses or register numbers that overlap. As a result, both the address (or register number) and the function code are required to comprehensively explain where to find a piece of data (or register type).

How does Modbus TCP communication work? ›

Modbus devices communicate using a master-slave (client-server) technique in which only one device (the master/client) can initiate transactions (called queries). The other devices (slaves/servers) respond by supplying the requested data to the master, or by taking the action requested in the query.

What are the two types of Modbus? ›

Two Channels: Modbus RTU vs Modbus TCP/IP

There are two types of Modbus serial protocols, RS-232 and RS-485. Modbus RS-232 allows concurrent, full-duplex flow of data. Modbus RS-485 is half-duplex, and indicates values using differences in voltage. Modbus messages can also be sent over Ethernet or TCP/IP.

What is an example of Modbus communication? ›

The Modbus message uses the register address. For example, the first register of AO Holding Register has the number 40001, but its address is 0000. The difference between these two quantities is “offset”. Each table has its own offset, respectively: 1, 10001, 30001 and 40001.

What voltage is Modbus? ›

The DIN-100 voltage input modules contain an isolated 15-bit analog to digital converter and measure DC voltages with full scale input ranges from +/-10mV to +/-100Vdc. Each module is hardware optimized for the best measurement performance over a certain input range.

How many wires is Modbus? ›

Wiring 485 modbus devices is nothing more than 2 wires (same as 4-20ma). Difference is that units can be daisy chained. This means that one can wire to node 1, and Node 1 can be connected to node 2. This does not require individual pair of wires for each node.

What are Modbus commands? ›

A Modbus command contains the Modbus address of the device it is intended for (1 to 247). Only the addressed device will respond and act on the command, even though other devices might receive it (an exception is specific broadcastable commands sent to node 0, which are acted on but not acknowledged).

What is the difference between Modbus and IP? ›

The Modbus messaging structure is the application protocol that defines the rules for organizing and interpreting the data independent of the datatransmission medium. TCP/IP refers to the Transmission Control Protocol and Internet Protocol, which provides the transmission medium for Modbus TCP/IP messaging.

How to understand Modbus data? ›

As mentioned before, Modbus data can be transmitted via a serial channel connecting two COM-based devices. They communicate information as series of ones and zeros (data bits) via a standard serial cable. Each bit is sent as a voltage. Modbus connection is rather fast and the normal transmission speed is 9600 baud.

Is Modbus wired or wireless? ›

Modbus is a serial communication protocol on the application layer used to transmit data between electronic devices used in the industrial automation and control industry. Wireless Modbus provides an added layer enabling Modbus devices to transmit information wirelessly.

What is the difference between Modbus and Modbus TCP? ›

The main difference is that Modbus RTU uses a daisy chain network, so you can link the whole network on two wires and communicate with each device by providing each node with a unique address. Modbus TCP uses a star network where each node has an individual cable called a Cat5 or Cat6.

How far can you run Modbus? ›

Typical Modbus RTU is RS-485 standard. 4000 feet (1200 meters) is generally accepted as maximum length.

What is the difference between Modbus and TCP? ›

There are two common types of Modbus – RTU and TCP/IP. Essentially, these are simply two different ways of transmitting data. While Modbus defines how the data is structured for transmission, RTU and TCP/IP wrap the structured data for specific methods of transmission.

What is the difference between Modbus and protocol? ›

Modbus is an application layer protocol, while DNP3 contains Application and Data Link Layers, with a pseudo-transport layer. Both protocols are widely used over a variety of physical layers, including RS-232, RS- 422, RS-485, and TCP/IP. Modbus has a separate specification for use over TCP/IP (Modbus-TCP).

What is the difference between RS485 and Modbus? ›

Modbus vs RS485

Data transmitted via an RS485 interface usually employs the MODBUS protocol. Alternatively, an RS232 device uses text (ASCII) protocols. The main difference is that Modbus articulates the protocol type, whereas RS485 defines the protocol's signal level.


Top Articles
Latest Posts
Article information

Author: Dr. Pierre Goyette

Last Updated: 09/17/2023

Views: 6045

Rating: 5 / 5 (50 voted)

Reviews: 89% of readers found this page helpful

Author information

Name: Dr. Pierre Goyette

Birthday: 1998-01-29

Address: Apt. 611 3357 Yong Plain, West Audra, IL 70053

Phone: +5819954278378

Job: Construction Director

Hobby: Embroidery, Creative writing, Shopping, Driving, Stand-up comedy, Coffee roasting, Scrapbooking

Introduction: My name is Dr. Pierre Goyette, I am a enchanting, powerful, jolly, rich, graceful, colorful, zany person who loves writing and wants to share my knowledge and understanding with you.