MODBUS

Ing. Marcelo Garcia T

Modbus.org :
http://www.modbus.org
Modicon site for Modbus users.
Transparent Factory :
http://www.transparentfactory.com
Schneider Electric site for Transparent Factory users.
Modbus Plus :
http://www.modicon.com/techpubs/toc6.html
Modbus Plus Planning and installation.
Introduccin
Diseado en 1979 por Modicon para su gama
de controladores lgicos programables
(PLCs).
Las razones por las cuales el uso de Modbus
es superior a otros protocolos de
comunicaciones son:
es pblico.
su implementacin es fcil y requiere poco desarrollo.
maneja bloques de datos sin suponer restricciones.
Basado en la arquitectura maestro/esclavo o
cliente/servidor.
Existen versiones del protocolo Modbus para
puerto serie y Ethernet (Modbus/TCP).
3
Application Structure (general)
Modbus Device (Slave) Modbus Device (Slave)
Interne
t
RS-232/485
HMI
SCADA
Modbus Client (Master)
Query-Response Cycle
P.5
Station Number
Data Bytes
(Flexible)
Error Check
Station Number
Function Code
Data Bytes
(Flexible)
Error Check
Query
Response
Function Code
MODBUS Protocol is a messaging structure created by MODICON
company to connect PLC to programming tools.
It is now widely used to establish master-slave communication between
intelligent devices.
MODBUS is independent of the physical layer.
It can be implemented using RS232, RS422, or RS485 or over a variety
of media (e.g. fiber, radio, cellular, etc...).
Referncia: MODBUS Application Protocol Specification V1.1b
MODBUS
MODBUS PLUS is a higher speed network 1 Mbit/s token passing derivative
that uses the MODBUS messaging structure.
Application
Presentation
Session
Transport
Network
Link
Physical
7
6
5
4
3
2
1
802.4 Token passing
Modbus
RS485
MODBUS TCP/IP uses TCP/IP and Ethernet 10 Mbit/s or 100
Mbits/s to carry the MODBUS messaging structure.
Application
Preentation
Session
Transport
Network
Link
Physical
7
6
5
4
3
2
1
CSMA / CD
ETHERNET V2 ou 802.3
Modbus
TCP
IP
Modbus modelo ISO
10
Modbus con enlace serie, opera de 1200bps a
56Kbps con mtodo de acceso maestro/esclavo
Modbus modelo ISO
Modbus Plus. Es un bus que opera a
1Mbps y el mtodo de acceso est basado
en Token-Ring
11
Modbus modelo ISO
Modbus Ethernet TCP/IP. Utiliza la
capa fsica Ethernet con velocidades de 10
Mbps y 100 Mbps y protocolos TCP/IP.
12
Ej. Arquitectura de una red Modbus
13
Capa Fsica RS-485
Medio: Cable de par trenzado apantallado.
Topologa: Bus.
Distancia: mx. 1300 m., entre
repetidores.
Velocidad: 1200 bps/56Kbps.
Nodos: 32 (1 master y 31 esclavos)
Conectores: RJ-45, SUB-DB9
14
Capa de Enlace
Mtodo de acceso al medio:
master/eslave.
Mtodo de transmisin: Cliente-Servidor.
Seguridad en la transmisin:
CRC y LCR
Bit de Start y Stop
Bit de paridad
Flujo continuo (control de flujo)
15
The MODBUS protocol comes in 2 versions :
ASCII transmission mode
Each eight-bit byte in a message is sent as 2 ASCII characters.
RTU transmission mode
Each eight-bit byte in a message is sent as two four-bit
hexadecimal
characters.
The main advantage of the RTU mode is that it achieves higher
throughput.
ASCII mode allows time intervals of up to 1 second to occur between
characters without causing an error.
Address Checksum Data Function
The Modbus frame structure is the same for requests (master to
slave messages) and responses (slave to master messages).
Modbus ASCII
Modbus RTU
: CR LF
3A Hex
0D Hex 0A Hex
Address Checksum Data Function
silence silence
Silence >= 3,5 characters
Address Checksum Data Function
Valid slave device addresses are in the range of 0 ... 247 decimal.
The individual slave devices are assigned addresses in the range of 1 ... 247.
Value 0 is reserved for broadcast messages (no response).
Request :
A master addresses a slave by placing the slave address in the address field of
the message.
Response :
When the slave sends its response, it places its own address in this address field
of the response to let the master know which slave is responding.
Valid codes are in the range of 1 ... 255 decimal.
Request :
The function code field tells the slave what kind of action to perform.
Response :
For a normal response, the slave simply echoes the original function code.
For an exception response, the slave returns a code that is equivalent to
the original function code with its most significant bit set to a logic 1.
Address Checksum Data Function
Valid codes are in the range of 0 ... 255 decimal.
Request :
The data field contains additional information which the slave must use to take
the action defined by the function code. This can include items like register
addresses, quantity of items to be handled, etc...
Response :
If no error occurs, the data field contains the data requested.
If an error occurs, the field contains an exception code that the master
application can use to determine the next action to be taken.
Data field
Address Checksum Data Function
Part 3 : Modbus frame description
Valid codes are in the range of 0 ... 255 decimal.
Modbus RTU uses CRC : Cyclycal Reduncy Check (2 byte)
Modbus ASCII uses LRC : Longitudinal Redundancy Check (1 bytes)
Request :
The checksum is calculated by the master and sends to the slave.
Response :
The checksum is re-calculated by the slave and compared to the value sent
by the master.
If a difference is detected, the slave will not construct a response to the master.
Address Checksum Data Function
Request :
Function code = 3 : Read n words
Slave
Address
CRC16
First word
address
Function
code = 3
Number of
words to read
1 byte 1 byte 2 bytes 2 bytes 2 bytes
Response :
Slave
Address
CRC16
Number of
bytes read
Function
code = 3
Value of the
first word
1 byte 1 byte 2 bytes 2 bytes 2 bytes
Value of the
last word
2 bytes
Modbus Message Packet
ASCII Mode
RTU Mode
Modbus Plus network
Byte 0, 1: transaction ID usually 0
Byte 2, 3: protocol ID = 0
Byte 4, 5: number of bytes following
Station NumberFunction Code Data Error Check End
2 Chars 2 Chars n Chars 2 Chars 2 Chars
Start
1 Char
: LRC CR,LF
Station NumberFunction Code Data Error Check End
1 Char 1 Char n Chars 2 Chars 3.5 Chars
Start
3.5 Char
Silence CRC Silence
Station NumberFunction Code Data Prefixed Data
6 x 8 Bits
Modbus Function Code
01: read DOs (0xxxx)
02: read DIs (1xxxx)
03: read AOs (4xxxx)
04: read AIs (3xxxx)
05: write single DO (0xxxx)
06: write single AO (4xxxx)
15: wirte DOs (0xxxx)
16: write AOs (4xxxx)
P.24
Code Type
01 Read n consecutive output bits
02 Read n consecutive input bits
03 Read n consecutive output words
04 Read n consecutive input words
05 Write 1 output bit
06 Write 1 output word
07 Read exception status
08 Access diagnostic counters
11 Read event counter
12 Read connection events
15 Write n output bits
16 Write n output words
17 Read identification
Parity checking
Even or odd can be optionally applied to each character.
Frame checking
LRC or CRC is applied to the entire message.
Continuous stream
The entire message frame must be transmitted as a continuous stream.
If a silent interval (more than 1.5 character times RTU mode or 1 second ASCII mode)
occurs before completion of the frame, the receiving device flushes the incomplete
message and assumes that the next byte will be the address field of a new message.
The master is configured by the user to wait for a predetermined
timeout
interval before aborting the transaction.
This interval is set to be long enough for any slave to respond normally.
If the slave detects a transmission error, the message will not be acted
upon.
The slave will not construct a response to the master.
Thus the timeout will expire and allow the master's program to handle
the error.
RS485 is the most physical layer used on Modbus.
32 devices included the master can be connected on the bus.
This is a bus topology with line terminations.