What is Modbus and how does it work? | Schneider Electric, USA (2023)

Problem:
This document describes how Modbus works and what needs to be done for a correct installation.

Production line:
All product lines

Environment:
All serial numbers

Cause:
to install

solution:

What is Modbus?

What is it for?

Modbus is an open protocol, which means that manufacturers can integrate it into their equipment free of charge, without incurring any licensing fees. It has become the industry standard communication protocol and is currently the most widely available means of interconnecting industrial electronic devices. It is widely used by many manufacturers in many industries. Modbus is typically used to send signals from instrumentation and control equipment back to a master controller or data collection system, such as a system that measures temperature and humidity, and transfers the results to a computer. Modbus is commonly used to connect a supervisory computer to an external terminal unit (RTU) in SCADA (supervision and data acquisition) systems. There are versions of the Modbus protocol for serial lines (Modbus RTU and Modbus ASCII) and for Ethernet networks (Modbus TCP).

How it's working?

Modbus is sent between devices via serial lines. The simplest configuration would be a single serial cable connecting the serial ports of two devices, client and server.

Data is sent as a string of ones and zeros called bits. Each bit is sent as a voltage. Zero is sent as positive voltage and ones as negative voltage. Bits are sent very quickly. Typical baud rate is 9600 baud (bits per second).

What is hexadecimal?

When troubleshooting, it can be helpful to see what raw data is actually being transferred. Long strings of 0s and 1s are hard to read, so the bits are concatenated and represented in hexadecimal. Each 4-bit block is represented by one of the sixteen characters from 0 to F.

Each block of 8 bits (called a byte) is represented by one of the 256 character pairs from 00 to FF.

How is data stored in the Modbus standard?

The information is stored in four different tables on the server device. Two tables hold discrete on/off values ​​(coils) and two hold numeric values ​​(registers). The coils and registers have a read-only table and a read-write table. Each table has 9999 values. Each coil or contact has 1 bit and is assigned a data address ranging from 0000 to 270E. Each register consists of 1 word = 16 bits = 2 bytes and also has a data address ranging from 0000 to 270E.

Scrolling/logging numbers can be thought of as location names as they do not appear in actual messages. Data addresses are used in messages. For example, the first property register number 40001 has data address 0000. The difference between the two values ​​ismovement. Each table has a different offset. 1, 10001, 30001 and 40001.

What is the server ID?

Each server on the network is assigned a unique address from 1 to 247. When a client requests data, the first byte sent is the address of the server. This way, after the first byte, each server knows whether to ignore the message or not.

What is the function code?

The second byte sent by the client is the function code. This number tells the server which table to access and whether to read or write to the table.

What is a CRC?

CRC stands for Cyclic Redundancy Check. These are two bytes added to the end of each Modbus message for error detection. Each byte of the message is used to calculate the CRC. The receiving device also calculates the CRC and compares it with the CRC of the sending device. If even one bit in the message is received incorrectly, the CRC will be different and an error will occur. .

What are the Modbus command and response formats?

What are data types?

The FC03 example shows that register 40108 contains AE41, which is converted to 16 bits. 1010 1110 0100 0001 Great! But what does it mean? Well, that could mean several things. Register 40108 can be defined as one of the following 16-bit data types:

AA 16-bit unsigned integer(integer from 0 to 65535) register 40108 contains AE41 = 44.609 (hexadecimal to decimal conversion)

AA 16-bit signed integer(integer between -32768 and 32767) AE41 = -20.927 (convert from hexadecimal to decimal by subtracting 65536 if greater than 32767)

Atwo-character ASCII character string(2 letters) AE41 = ® A

AA 32-bit unsigned integer(a number from 0 to 4,294,967,295) 40108.40109 = AE41 5652 = 2,923,517,522

AA 32-bit signed integer(number from -2 147 483 648 to 2 147 483 647) AE41 5652 = -1 371 449 774

AIEEE 32-bit double-precision floating point number. This is a mathematical formula that can represent any real number (a number with decimal places) in 32 bits with a precision of about seven digits. AE41 5652 = -4.395978 E-11 Here is an IEEE floating point calculator spreadsheet for 4 bytes or 2 words. To download a copy, right-click and select Save Target As...

AA four-character ASCII string(4 letters typed) AE41 5652 = ® A VR R You can combine multiple registers into longer ASCII sequences. Each register is used to store two ASCII characters (two bytes).

What is byte and word order?

The Modbus specification does not precisely define how data is stored in registers. Therefore, some manufacturers have implemented the Modbus protocol in their equipment to store and transmit the first byte followed by the lower byte. (AE before 41). Alternatively, others may write and send the lower byte first (41 before AE). Similarly, when registers are combined to represent 32-bit data types, some devices store the upper 16 bits (highest word) in the first register and the remaining lower word in the second (AE41 before 5652), while others store the reverse. (5652). before AE41) It doesn't matter what order the bytes or words are sent as long as the receiving device knows how to expect it. For example, if the number 29,235,175,522 was sent as an unsigned 32-bit integer, it can be arranged in one of four ways.

AE41 5652 - high byte, first high word

5652 AE41 - high byte, low first word

41AE 5256 First high word in low byte

5256 41AE first low byte first low word

What is a Modbus card?

The Modbus map is simply a list of individual server devices that defines what data (pressure or temperature readings, for example) are

- where the data is stored (which tables and data addresses)

- data storage method (data types, byte and word order)

Some devices are built with a fixed map defined by the manufacturer. While other devices allow the operator to configure or program a custom card to suit his needs.

What is the difference between Modbus ASCII and Modbus RTU?

What are extended register addresses?

Since the register range of the analog output is from 40001 to 49999, it means that there can be no more than 9999 registers. While this is usually sufficient for most applications, there are cases where more registers would be useful. Registers 40001 to 49999 correspond to data addresses 0000 to 270E. Using the remaining data addresses 270F to FFFF, more than six times as many registers are available, for a total of 65536. This would correspond to register numbers 40001 to 105536. Many Modbus software drivers (for client computers) are written with limits of 40001 to 49999, and there are no access to extended registers on server devices. Many server devices do not support directories that use extended registers. On the other hand, some server devices support these registers and some client programs can access them, especially if custom software has been written.

How does 2-byte server addressing work?

Since a single byte is usually used to specify a server address, and each server in a network requires a unique address, the number of servers in a network is limited to 256. The limit specified in the Modbus specification is even lower: 247. If you exceed this limit, you can change the protocol, to use two bytes in the address. The client and servers should support this change. Double-byte addressing increases the limit on the number of servers in the network to 65535. Simply Modbus software uses 1-byte addressing by default. When an address greater than 255 is entered, the software automatically switches to 2-byte addressing and remains in this mode for all addresses until 2-byte addressing is manually disabled.

How can you upload events and historical data?

Enron Modbus includes commands to transfer events and historical data.

What is Enron Modbus?

Enron Modbus is a modification of the standard Modicon Modbus communication protocol developed by Enron Corporation.

See Enron Modbus for details.

Released for:Schneider Electric SAD