Modbus Protocol
PDF format version of the MODBUS Protocol
The original was found at:
http://www.http://www.modicon.com/techpubs/toc7.html
(In case of any discrepancies, that version should be considered accurate.)
Hope you find this useful!
Spehro Pefhany, January 2000
3-1750 The Queensway Suite 1298 Toronto ON Canada M9C 4H5
(905) 271-4477
fax: (905) 271-9838 e-mail: info@trexon.com
Modbus Protocol
Chapter 1 Modbus Protocol
Chapter 2 Data and Control Functions
Chapter 3 Diagnostic Subfunctions
Chapter 4 Exception Responses
Chapter 5 Application Notes
Chapter 6 LRC / CRC Generation
http://www.modicon.com/techpubs/toc7.html [1/11/2000 10:32:59 PM]
Modbus Protocol
Chapter 1
Modbus Protocol
V
Introducing Modbus Protocol
V Two Serial Transmission Modes
V Modbus Message Framing
V Error Checking Methods
1.1 Introducing Modbus Protocol
Modicon programmable controllers can communicate with each other and with other devices
over a variety of networks. Supported networks include the Modicon Modbus and Modbus Plus
industrial networks, and standard networks such as MAP and Ethernet. Networks are accessed
by built-in ports in the controllers or by network adapters, option modules, and gateways that
are available from Modicon. For original equipment manufacturers, Modicon ModConnect
partner programs are available for closely integrating networks like Modbus Plus into
proprietary product designs.
The common language used by all Modicon controllers is the Modbus protocol. This protocol
defines a message structure that controllers will recognize and use, regardless of the type of
networks over which they communicate. It describes the process a controller uses to request
access to another device, how it will respond to requests from the other devices, and how errors
will be detected and reported. It establishes a common format for the layout and contents of
message fields.
The Modbus protocol provides the internal standard that the Modicon controllers use for
parsing messages. During communications on a Modbus network, the protocol determines how
each controller will know its device address, recognize a message addressed to it, determine the
kind of action to be taken, and extract any data or other information contained in the message. If
a reply is required, the controller will construct the reply message and send it using Modbus
protocol.
On other networks, messages containing Modbus protocol are imbedded into the frame or
packet structure that is used on the network. For example, Modicon network controllers for
Modbus Plus or MAP, with associated application software libraries and drivers, provide
conversion between the imbedded Modbus message protocol and the specific framing protocols
those networks use to communicate between their node devices.
This conversion also extends to resolving node addresses, routing paths, and error-checking
methods specific to each kind of network. For example, Modbus device addresses contained in
the Modbus protocol will be converted into node addresses prior to transmission of the
messages. Error-checking fields will also be applied to message packets, consistent with each
http://www.modicon.com/techpubs/intr7.html (1 of 5) [1/11/2000 10:36:08 PM]
Modbus Protocol
network's protocol. At the final point of delivery, however-for example, a controller-the
contents of the imbedded message, written using Modbus protocol, define the action to be
taken.
Figure 1 shows how devices might be interconnected in a hierarchy of networks that employ
widely differing communication techniques. In message transactions, the Modbus protocol
imbedded into each network's packet structure provides the common language by which the
devices can exchange data.
Figure 1 Overview of Modbus Protocol Application
1.1.1 Transactions on Modbus Networks
Standard Modbus ports on Modicon controllers use an RS-232C compatible serial interface that
defines connector pinouts, cabling, signal levels, transmission baud rates, and parity checking.
Controllers can be networked directly or via modems.
Controllers communicate using a master-slave technique, in which only one device (the master)
can initiate transactions (queries). The other devices (the slaves) respond by supplying the
requested data to the master, or by taking the action requested in the query. Typical master
devices include host processors and programming panels. Typical slaves include programmable
http://www.modicon.com/techpubs/intr7.html (2 of 5) [1/11/2000 10:36:08 PM]
Modbus Protocol
controllers.
The master can address individual slaves, or can initiate a broadcast message to all slaves.
Slaves return a message (response) to queries that are addressed to them individually.
Responses are not returned to broadcast queries from the master.
The Modbus protocol establishes the format for the master's query by placing into it the device
(or broadcast) address, a function code defining the requested action, any data to be sent, and an
error-checking field. The slave's response message is also constructed using Modbus protocol. It
contains fields confirming the action taken, any data to be returned, and an error-checking field.
If an error occurred in receipt of the message, or if the slave is unable to perform the requested
action, the slave will construct an error message and send it as its response.
1.1.2 Transactions on Other Kinds of Networks
In addition to their standard Modbus capabilities, some Modicon controller models can
communicate over Modbus Plus using built-in ports or network adapters, and over MAP, using
network adapters.
On these networks, the controllers communicate using a peer-to-peer technique, in which any
controller can initiate transactions with the other controllers. Thus a controller may operate
either as a slave or as a master in separate transactions. Multiple internal paths are frequently
provided to allow concurrent processing of master and slave transactions.
At the message level, the Modbus protocol still applies the master-slave principle even though
the network communication method is peer-to-peer. If a controller originates a message, it does
so as a master device, and expects a response from a slave device. Similarly, when a controller
receives a message it constructs a slave response and returns it to the originating controller.
1.1.3 The Query-Response Cycle
Figure 2 Master-Slave Query-Response Cycle
The Query
The function code in the query tells the addressed slave device what kind of action to perform.
The data bytes contain any additional information that the slave will need to perform the
function. For example, function code 03 will query the slave to read holding registers and
respond with their contents. The data field must contain the information telling the slave which
http://www.modicon.com/techpubs/intr7.html (3 of 5) [1/11/2000 10:36:08 PM]
Modbus Protocol
register to start at and how many registers to read. The error check field provides a method for
the slave to validate the integrity of the message contents.
The Response
If the slave makes a normal response, the function code in the response is an echo of the
function code in the query. The data bytes contain the data collected by the slave, such as
register values or status. If an error occurs, the function code is modified to indicate that the
response is an error response, and the data bytes contain a code that describes the error. The
error check field allows the master to confirm that the message contents are valid.
1.2 Two Serial Transmission Modes
Controllers can be setup to communicate on standard Modbus networks using either of two
transmission modes: ASCII or RTU. Users select the desired mode, along with the serial port
communication parameters (baud rate, parity mode, etc), during configuration of each
controller. The mode and serial parameters must be the same for all devices on a Modbus
network.
The selection of ASCII or RTU mode pertains only to standard Modbus networks. It defines the
bit contents of message fields transmitted serially on those networks. It determines how
information will be packed into the message fields and decoded.
On other networks like MAP and Modbus Plus, Modbus messages are placed into frames that
are not related to serial tranasmission. For example, a request to read holding registers can be
handled between two controllers on Modbus Plus without regard to the current setup of either
controller's serial Modbus port.
1.2.1 ASCII Mode
When controllers are setup to communicate on a Modbus network using ASCII (American
Standard Code for Information Interchange) mode, each eight-bit byte in a message is sent as
two ASCII characters. The main advantage of this mode is that it allows time intervals of up to
one second to occur between characters without causing an error.
Coding System
V Hexadecimal, ASCII characters 0 ... 9, A ... F
V One hexadecimal character contained in each ASCII character of the message
Bits per Byte
V 1 start bit
V 7 data bits, least significant bit sent first
V 1 bit for even / odd parity-no bit for no parity
V 1 stop bit if parity is used-2 bits if no parity
Error Check Field
http://www.modicon.com/techpubs/intr7.html (4 of 5) [1/11/2000 10:36:08 PM]
Modbus Protocol
V Longitudinal Redundancy Check (LRC)
1.2.2 RTU Mode
When controllers are setup to communicate on a Modbus network using RTU (Remote
Terminal Unit) mode, each eight-bit byte in a message contains two four-bit hexadecimal
characters. The main advantage of this mode is that its greater character density allows better
data throughput than ASCII for the same baud rate. Each message must be transmitted in a
continuous stream.
Coding System
V Eight-bit binary, hexadecimal 0 ... 9, A ... F
V Two hexadecimal characters contained in each eight-bit field of the message
Bits per Byte
V 1 start bit
V 8 data bits, least significant bit sent first
V 1 bit for even / odd parity-no bit for no parity
V 1 stop bit if parity is used-2 bits if no parity
Error Check Field
V Cyclical Redundancy Check (CRC)
1.3 Modbus Message Framing
In either of the two serial transmission modes (ASCII or RTU), a Modbus message is placed by
the transmitting device into a frame that has a known beginning and ending point. This allows
receiving devices to begin at the start of the message, read the address portion and determine
which device is addressed (or all devices, if the message is broadcast), and to know when the
message is completed. Partial messages can be detected and errors can be set as a result.
On networks like MAP or Modbus Plus, the network protocol handles the framing of messages
with beginning and end delimiters that are specific to the network. Those protocols also handle
delivery to the destination device, making the Modbus address field imbedded in the message
unnecessary for the actual transmission. (The Modbus address is converted to a network node
address and routing path by the originating controller or its network adapter.)
1.3.1 ASCII Framing
In ASCII mode, messages start with a colon ( : ) character (ASCII 3A hex), and end with a
carriage return-line feed (CRLF) pair (ASCII 0D and 0A hex).
The allowable characters transmitted for all other fields are hexadecimal 0 ... 9, A ... F.
Networked devices monitor the network bus continuously for the colon character. Wh
http://www.modicon.com/techpubs/intr7.html (5 of 5) [1/11/2000 10:36:08 PM]
Chapter 2
Data and Control Functions
V Modbus Function Formats
V
V
V
V
V
V
V
V
V
V
V
V
V
V
Function Codes
Read Coil Status
Read Input Status
Read Holding Registers
Read Input Registers
Force Single Coil
Preset Single Register
Read Exception Status
Fetch Comm Event Counter
Fetch Comm Event Log
Force Multiple Coils
Preset Multiple Registers
Report Slave ID
Read General Reference
V Write General Reference
V Mask Write 4x Register
V
Read / Write 4x Registers
http://www.modicon.com/techpubs/dcon7.html (1 of 36) [1/11/2000 10:41:03 PM]