Industrial Communication

Chapter 2: Modbus Serial

Modbus Serial Features

Industrial Communication Course with Unity Pro - Modbus

Schneider Electric | Industry Business | Training | E. Pauchet V5.0 May 2010 2
Introduction

Modbus = Modicon Bus (1979)

is an application layer messaging protocol for client/server communication
between devices connected on the bus.
Independent from the other layers
Openly published and royalty-free
Relatively easy industrial network to deploy
It moves raw bits or words without placing many restrictions on vendors

Various versions
Modbus RTU (Serial), Modbus ASCII, Modbus Ethernet TCP/IP, Modbus
Plus (Proprietary of =S=)

Industrial Communication Course with Unity Pro - Modbus

Schneider Electric | Industry Business | Training | E. Pauchet V5.0 May 2010 3
Layers Used in OSI Model

3 Layers used for Modbus Serial

APPLICATION Modbus Protocol

PRESENTATION Not used

SESSION Not used

TRANSPORT Not used

NETWORK Not used

DATALINK Master / Slave, Transmission RTU / ASCII

PHYSICAL RS485, RS422, Fiber Optic, Radio, Cellular,

Industrial Communication Course with Unity Pro - Modbus

Schneider Electric | Industry Business | Training | E. Pauchet V5.0 May 2010 4
Physical Layer
Required Multi-point and
RS485 2 wire point-to-point

To integrate into an
RS485 4 wire Optional
existing installation
without modification

RS232 Optional Point-to-point mode

15 meter max.

Transmission speeds:
9600 bps and 19200 bps required with 19.2 Kbps by default
Other speeds: 1200, 2400, 4800, 38400, 56 Kbps, 115 Kbps optional

RS485 is the most common physical layer used on Modbus. 32

devices included the master can be connected on the bus.
Industrial Communication Course with Unity Pro - Modbus
Schneider Electric | Industry Business | Training | E. Pauchet V5.0 May 2010 5
 Modbus RS485 2 wire installation
Master

T
R

5V

650 ohms

Balanced pair
650 ohms 120 ohms
120 ohms
1 nF
Common 1 nF

PG
R R
T T

Slave 1 Slave n Max. number of devices:

32 including master without a repeater

Max. length:
Main segment: 1,000 m at 19,200 bits/s
Topology: bus type Drops: 40 m in total (20 m for one tap link)

Industrial Communication Course with Unity Pro - Modbus

Schneider Electric | Industry Business | Training | E. Pauchet V5.0 May 2010 7
Data Transmission

Method of accessing the medium

Master slave

Transmission method:
Client / Server

Max. useful data size:

120 words

Industrial Communication Course with Unity Pro - Modbus

Schneider Electric | Industry Business | Training | E. Pauchet V5.0 May 2010 8
Unicast Addressing Mode
Address = 1 to 247

Request
Funct.
5 Code
Request data CRC

Adr 1 Adr 2 Adr 3 Adr 4 Adr 5 Adr n

Response
Funct.
5 Code
Response data CRC

Industrial Communication Course with Unity Pro - Modbus

Schneider Electric | Industry Business | Training | E. Pauchet V5.0 May 2010 9
Broadcast Addressing Mode
Address = 0
Request
Funct.
0 Code
Request data CRC

Adr 1 Adr 2 Adr 3 Adr 4 Adr 5 Adr n

No response from slaves

Used only with write functions

Industrial Communication Course with Unity Pro - Modbus

Schneider Electric | Industry Business | Training | E. Pauchet V5.0 May 2010 10
Transmission Modes

ASCII transmission mode

Every data item is encoded in two ASCII characters (7 bits)
allows time intervals of up to 1 second to occur between characters without
causing an error.
Used with Modem / Barcodes

RTU transmission mode

Every data item is encoded in one byte (8 bits)
Achieves higher throughput & reliability
Used with PLC / SCADA

Industrial Communication Course with Unity Pro - Modbus

Schneider Electric | Industry Business | Training | E. Pauchet V5.0 May 2010 11
Modbus Serial Frame
Modbus PDU
PDU = Protocol Data Unit

Function
Address Data CRC or LRC
Code

= 0 to 247 = 1 to 127 Additional data depending Validity

Identifies the Action to on the Function Code check
addressee perform

Unicast Address field = 1 to 247

Two
addressing Broadcast Address field = 0
modes:
(used in write only mode)

Industrial Communication Course with Unity Pro - Modbus

Schneider Electric | Industry Business | Training | E. Pauchet V5.0 May 2010 12
Address Field

Address Function Data Checksum

Valid device addresses : 0 to 247 decimal. Value 0

reserved for broadcast message (no reponse)

Request
A master addresses a slave by placing the slave address in the address
field of the message.

Response
When the slave sends its response, it places its own address in this address
field of the response to let the master know which slave is responding.

Industrial Communication Course with Unity Pro - Modbus

Schneider Electric | Industry Business | Training | E. Pauchet V5.0 May 2010 13
Function Field

Address Function Data Checksum

Valid codes are in the range of 1

to 255 decimal.

Request
The function code field tells the slave what kind of action to perform.

Response
For a normal response, the slave simply echoes the original function code.
For an exception response, the slave returns a code that is equivalent to the
original function code with its most significant bit set to a logic 1.

Industrial Communication Course with Unity Pro - Modbus

Schneider Electric | Industry Business | Training | E. Pauchet V5.0 May 2010 14
Data Field

Address Function Data Checksum

Request
The data field contains additional information which the slave must use to
take the action defined by the function code. This can include items like
register addresses, quantity of items to be handled, etc...

Response
If no error occurs, the data field contains the data requested.
If an error occurs, the field contains an exception code that the master.
Application used to determine the next action to be taken.

Industrial Communication Course with Unity Pro - Modbus

Schneider Electric | Industry Business | Training | E. Pauchet V5.0 May 2010 15
Checksum Field
Address Function Data Checksum

Modbus RTU uses CRC

Cyclical Redundancy Check (2 bytes)
Modbus ASCII uses LRC
Longitudinal Redundancy Check (1 byte)

Request
The checksum is calculated by the master and sends to the slave.

Response
The checksum is re-calculated by the slave and compared to the value sent
by the master. If a difference is detected, the slave will not construct a
response to the master.

Industrial Communication Course with Unity Pro - Modbus

Schneider Electric | Industry Business | Training | E. Pauchet V5.0 May 2010 16
Function Codes

Code Function

01 (0x01) Read n consecutive output bits

02 (0x02) Read n consecutive input bits
03 (0x03) Read n consecutive output words
04 (0x04) Read n consecutive input words
05 (0x05) Write 1 output bit
06 (0x06) Write 1 output word
07 (0x07) Read exception status
08 (0x08) Access diagnostic counters
15 (0x0F) Write n output bits
16 (0x10) Write n output words
23 (0x17) Read/Write n output words
43 (0x2B) Read identification

[Link]
Industrial Communication Course with Unity Pro - Modbus
Schneider Electric | Industry Business | Training | E. Pauchet V5.0 May 2010 17
Example of Read Request

Request
1 byte 1 byte 2 bytes 2 bytes 2 bytes
Slave Function First word Number of
CRC16
Address code = 3 address words to read

Response
1 byte 1 byte 2 bytes 2 bytes 2 bytes 2 bytes
Slave Function Number of Value of the Value of the
last word CRC16
Address code = 3 bytes read first word

Industrial Communication Course with Unity Pro - Modbus

Schneider Electric | Industry Business | Training | E. Pauchet V5.0 May 2010 18
Registers & Index

Registers
Memory variable located in a device
Word, Bit, Byte, etc
Can be reached thanks to its Index

Inputs Registers: read only (status)

Outputs Registers: read / write (commands)

Industrial Communication Course with Unity Pro - Modbus

Schneider Electric | Industry Business | Training | E. Pauchet V5.0 May 2010 19
Programming Modbus with Unity Pro

Industrial Communication Course with Unity Pro - Modbus

Schneider Electric | Industry Business | Training | E. Pauchet V5.0 May 2010 20
1 Platform, 3 Target

3 PLC Targets
M340, Premium, Quantum

Same Philosophy

Different Function Blocks

Industrial Communication Course with Unity Pro - Modbus

Schneider Electric | Industry Business | Training | E. Pauchet V5.0 May 2010 21
BMXNOM0200

Safety screw (1)

Display block with 4 LEDs: (2)
RUN (green) and ERR (red): Module status
SER COM (green): Activity on the serial link (lit) or
fault (flashing).
Channel 0 (3a & 3b)
RS 232C connection, marked COM Port 0 RS232
RS 485 connection, marked COM Port 0 RS485
Channel 1 (4)
RS 485 connection, marked COM Port 1 RS485

Industrial Communication Course with Unity Pro - Modbus

Schneider Electric | Industry Business | Training | E. Pauchet V5.0 May 2010 22
BMXNOM0200 Configuration

Industrial Communication Course with Unity Pro - Modbus

Schneider Electric | Industry Business | Training | E. Pauchet V5.0 May 2010 23
Request Programming
Dedicated Function Blocks for M340
ADDM
Address Conversion

READ_VAR
Execute a read request

WRITE_VAR
Execute a write request

DATA_EXCH
Execute a user defined request

OUT_IN_MBUS
Change from Slave to Master mode
Industrial Communication Course with Unity Pro - Modbus
Schneider Electric | Industry Business | Training | E. Pauchet V5.0 May 2010 24
ADDM FB

IN:
String variable: [Link]
Out
Converted table of words, to be used in the others FB

[Link]
r = the rack number where the Modbus module is located,
m = the slot number of the Modbus module,
c = the channel used
e = the equipment address (slave address) of the target
MBS = used to indicates to use Modbus Serial (optional)

Industrial Communication Course with Unity Pro - Modbus

Schneider Electric | Industry Business | Training | E. Pauchet V5.0 May 2010 25
READ_VAR FB

IN:
ADR: to be linked to the output of the ADDM block.
OBJ: defining object to read (in the case of Modbus register: %MW)
NUM: starting register to read
NB: number of consecutive register to read
OUT
RECP: reception zone of the block, delivering the value read (table of
words)
IN/OUT
GEST: table of 4 words to manage the communication block (errors,
timeout, length, etc..)

Industrial Communication Course with Unity Pro - Modbus

Schneider Electric | Industry Business | Training | E. Pauchet V5.0 May 2010 26
WRITE_VAR FB

IN:
ADR: to be linked to the output of the ADDM block.
OBJ: defining object to write (in the case of Modbus register: %MW)
NUM: starting register to write
NB: number of registers to write
EMIS: source table to write from the PLC

IN/OUT
GEST: table of 4 words to manage the communication block (errors,
timeout, length, etc..)

Industrial Communication Course with Unity Pro - Modbus

Schneider Electric | Industry Business | Training | E. Pauchet V5.0 May 2010 27
GEST Variable

Structured Variable
Table of 4 words

Most Significant Byte Least Significant Byte

GEST[1] Exchange number (updated Activity bit: 1 = exchange in

each time the request is progress, 0 = exchange
executed) terminated.

GEST[2] Operation report Communication Report

GEST[3] Timeout

GEST[4] Length

Industrial Communication Course with Unity Pro - Modbus

Schneider Electric | Industry Business | Training | E. Pauchet V5.0 May 2010 28
Exercise

Add & Configure Modbus Module (p 2-13)

Add a module
Configure the channel
Set the Modbus Slave address (Tesys U)
Insert the ADDM block
Create the READ_VAR request (to read status register
index 455)
Test the application

Industrial Communication Course with Unity Pro - Modbus

Schneider Electric | Industry Business | Training | E. Pauchet V5.0 May 2010 29
Optimizing Communication

Beware of Communication Buffer Overload

Usage of the Activity Bit (GEST[1].X0)

Industrial Communication Course with Unity Pro - Modbus

Schneider Electric | Industry Business | Training | E. Pauchet V5.0 May 2010 30
Optimizing Communication (Example)

Conditioning with the Activity Bit

Avoid buffer overload
Ensure that the next block is send when the previous is finished.

Industrial Communication Course with Unity Pro - Modbus

Schneider Electric | Industry Business | Training | E. Pauchet V5.0 May 2010 31
Optimizing Communication (Cont.)

Device Timeout
Mean to know if the Master is lost
After a defined time without receiving request, Slave goes to fallback mode

Allo, anybody
still there?

Fallback Mode
Mode activated when communication is lost
Behaviour to define (start a motor, stop a process, switch off outputs..)

No
answers
great, lets go
party!

Industrial Communication Course with Unity Pro - Modbus

Schneider Electric | Industry Business | Training | E. Pauchet V5.0 May 2010 32
Exercise

Optimizing the Communication (2-16)

Insert the Activity Bit as condition
Insert the WRITE_VAR function (to write into command
register 704)
Test the communication

Testing the TimeOut (2-20)

Use WRITE_VAR to change the Timeout parameter
Test the communication

Industrial Communication Course with Unity Pro - Modbus

Schneider Electric | Industry Business | Training | E. Pauchet V5.0 May 2010 33
Modbus Serial RTU

Main Features Reminder:

Up to 1200m whatever the baud rate value
Performance: Depends on the PLC application and how its managed.
Up to 32 Devices (31 slaves)
Baudrates: 1,2kbit/s... 19,2kbit/s
max 240 bytes per telegram
No separate ground wire
Good error detection (CRC)

Industrial Communication Course with Unity Pro - Modbus

Schneider Electric | Industry Business | Training | E. Pauchet V5.0 May 2010 34