author
Bobby Brown
Post 2024-12-02
Modbus 通訊協定是什麼?Modbus RTU一次搞懂

Contents


1. What Is a Communication Protocol?

A communication protocol, also referred to as a protocol, is a set of rules that define how data is exchanged between different devices in the industrial automation field. In essence, it acts as the "language" through which electronic devices communicate.

To illustrate, think about how human communication works: if two people don’t share a common language, they cannot understand each other. Similarly, industrial electronic devices require a shared communication protocol to exchange information effectively. When their protocols differ, the devices are unable to transmit or interpret data.

This concept is crucial in automation, where diverse systems such as programmable logic controllers (PLCs), sensors, and human-machine interfaces (HMIs) must collaborate seamlessly. Protocols ensure that these devices "speak" a common language, enabling smooth integration and operation.

2. What Is the Modbus Communication Protocol?

Modbus is a widely used communication protocol in industrial automation, serving as a common language for devices to communicate.

Like human communication requiring both language and a medium, devices need a communication protocol to define data exchange rules and a communication standard (e.g., RS-232, RS-485, Ethernet) for signal transmission.

Modbus works across different physical layers, adapting to various scenarios for efficient data exchange.
[1]

3. Types of Modbus Communication Protocols

Modbus RTU vs Modbus TCP
The Modbus communication protocol is categorized into two main types based on the communication standard used: serial communication and Ethernet communication.

1. Serial Communication

In serial communication, data is transmitted bit by bit, and it includes two protocols: Modbus RTU and Modbus ASCII.

  • Modbus RTU:
    • Uses binary encoding for data transmission.
    • Commonly paired with RS-232, RS-485, or RS-422 serial interfaces.
    • Ideal for short distances and multi-device applications.
    • Widely used in the industry due to its compact and efficient data format.
  • Modbus ASCII:
    • Uses the American Standard Code for Information Interchange (ASCII) for data encoding.
    • Also paired with RS-232, RS-485, or RS-422 interfaces.
    • ASCII encoding is easier to manually verify but consumes more storage space.

2. Ethernet Communication

  • Modbus TCP:
    • Operates over Ethernet, based on the TCP/IP protocol.
    • Uses network cables or wireless connections for data transmission.
    • Commonly applied in networked automation systems or remote monitoring setups.

Key Differences Between Modbus RTU and Modbus ASCII

While Modbus RTU and Modbus ASCII differ in encoding formats, their actual transmission speed depends on the baud rate of the serial interface (e.g., RS-232, RS-485).

  • Modbus RTU: Binary format, compact data structure, suitable for bandwidth-limited environments.
  • Modbus ASCII: ASCII format, each byte is represented by two ASCII characters, resulting in larger data size and slower transmission.
[2][3]

4. Why Do Many PLCs Use the Modbus Protocol?

Many manufacturers choose the Modbus communication protocol for their PLCs (Programmable Logic Controllers) due to its simplicity and cost-effectiveness. The protocol's straightforward structure and the fact that it is free to use without licensing fees make it an attractive option.

Key Advantages of Modbus for PLCs:

  1. Simple Structure & Free Licensing:

    Modbus is easy to implement, reducing development complexity and costs.

  2. Support for Multiple Interfaces:
    • Compatible with RS-232, RS-485, and TCP/IP interfaces.
    • Adapts to various physical transmission media, such as twisted-pair cables, fiber optics, and wireless networks.
  3. Flexibility Across Different Protocol Types:

    As discussed in the third section, Modbus protocols can be tailored for specific networks:

    • Fieldbus Networks: Protocols like Modbus RTU, Profibus, CC-Link, and CAN often use RS-485 for communication, supporting master-slave architectures or connections between controllers, devices, and nodes.
    • Ethernet Networks: Protocols such as Modbus TCP, PROFINET, EtherCAT, and EtherNet/IP enable efficient communication between clients and servers or controllers and devices.
  4. High Compatibility with Industrial Networks:

    Modbus is highly compatible with both Ethernet and RS-485 networks, meeting the demands of industrial automation systems.

Due to its simplicity, versatility, and excellent compatibility with industrial communication standards, Modbus has become the preferred communication protocol for many PLC manufacturers. It offers reliable and efficient solutions for both fieldbus and Ethernet-based applications.
Protocol Type Protocol Name Network Role
Industrial Ethernet Modbus-TCP Ethernet Client and Server
PROFINET Ethernet Controller and Device
EtherCAT Ethernet Master and Slave
EtherNet/IP Ethernet Controller and Device
Fieldbus Modbus-RTU RS485 Master and Slave
Profibus RS485 Master and Slave
CC-Link RS485 Master and Slave
CAN RS485 Controller and Node

*Common protocols and their functional roles

[4]

5. How Does Modbus RTU Work?

The Modbus RTU protocol uses a master-slave architecture where the master controls and initiates all communications, while slaves receive and respond to commands.

A master request includes a specific slave address, identifying the target device. Although all slaves receive the request, only the addressed device responds.

    For example, consider a scenario with three slave devices assigned addresses 1, 2, and 3:
  • If the master device sends a request to the slave device with address 2, only the slave with address 2 will respond, while the other devices will remain silent.
  • If the master device uses broadcast mode (where the slave address in the request is set to 0), all slave devices (1, 2, and 3) will execute the command, but none will respond to the master device.

    This architecture ensures efficient communication and precise control in systems where multiple slave devices are connected to a single master.
Modbus RTU master-slave architecture

5-1、Modbus Communication Packet

In Modbus RTU communication, the packet structure includes the following components:
  • Address: Identifies the slave device to receive the command.
  • Function Code: Specifies the operation the slave should perform, such as reading or writing registers.
  • Data: Contains information related to the request, such as the address and quantity of registers to read or write.
  • Error Check Code (CRC Check): Ensures data integrity during transmission. (In Modbus TCP, a similar packet structure is used, but CRC is omitted, relying instead on TCP/IP-level checks.)
  • *scroll to chapter 6 for an example.
[5]

5-2、Modbus Protocol Data Register Types

(The following content is compiled from Modbus Tools - Introduction to Modbus RTU. For more detailed register types and function code explanations, please refer to the original sources.)

The Modbus protocol categorizes the data storage area into four main types, managed through function codes for different data types:
  • Discrete Inputs: Read-only binary input data, corresponding to function code 0x02, used for reading device statuses.
  • Coils: Read-write binary output data, corresponding to function code 0x01, commonly used to control device switches.
  • Input Registers: Read-only analog input data, corresponding to function code 0x04, used for monitoring sensors or other input devices.
  • Holding Registers: Read-write analog data, corresponding to function codes 0x03 and 0x06, typically used for setting device parameters or states.
 
[6]

5-3、Modbus Function Codes and Their Operations

The Modbus protocol defines various function codes that control how a device reads or writes data. Common function codes and their applications are as follows:
1. 0x01 - Read Coils: Reads the on/off status of devices, commonly used to monitor switches or relays.
2. 0x02 - Read Discrete Inputs: Monitors binary input status, such as button or sensor states.
3. 0x03 - Read Holding Registers: Monitors operational parameters or states, typically used to read device settings or runtime data.
4. 0x04 - Read Input Registers: Used to monitor analog inputs, such as data from temperature or pressure sensors.
5. 0x05 - Write Single Coil: Controls the on/off state of a single device.
6. 0x06 - Write Single Holding Register: Modifies device parameters, such as speed or temperature settings.
7. 0x0F (15) - Write Multiple Coils: Controls the on/off state of multiple devices simultaneously.
8. 0x10 (16) - Write Multiple Holding Registers: Sets multiple device parameters at once.

5-4、What is Modicom Format?

The Modicom Format specifies the address numbering structure for Modbus, associating specific address ranges with function codes. This design allows operators to enter only an address without manually specifying a function code, reducing errors and simplifying communication.
 
Reference:Modicon Modbus Protocol Reference Guide

5-5、What Do +40001 / +30001 Mean?

According to the Modicon format, Modbus utilizes specific address ranges to denote different types of registers. For examples: 0001–39999: Input Registers (Function Code 04), 40001–49999: Holding Registers (Function Code 03)

What does +40001 signify?
In the Modicon format, the address range 40001–49999 corresponds to Holding Registers accessed using Function Code 03. Here, 40001 serves as the base address. For instance, 40001 represents the first register with an offset of 0000, indicating the read position is 0000.
When a user inputs 40005, Modbus automatically recognizes that addresses 40001–49999 correspond to Holding Registers (Function Code 03). According to the addressing logic, Modbus interprets 40005 as 40001 + 0004, thus reading the 0004 position within the Function Code 03 register.

Modbus Function Code
[7]

6. Implementing Flow Monitoring Between a PLC and Flow Meter Using RS485 and Modbus RTU

In the Modbus protocol, each data field has a specific meaning and position. Users need to input a sequence of codes, which represent: "slave address, function code (for reading input registers), register address, number of registers to read, and CRC check code." Upon receiving these data, the Modbus master parses each field according to the Modbus format to determine the operation on the target slave, such as reading or writing a register. Here’s an example implementation of flow monitoring between a PLC and a flow meter using RS485 and Modbus RTU:
-Hardware Setup: Ensure that both the flow meter and PLC have RS485 interfaces and support Modbus RTU communication. Connect the PLC and flow meter through RS485 communication wiring.
-Modbus RTU Configuration and Program Design: Set the Modbus address of the flow meter (e.g., the slave address) and parameters like baud rate. Configure the PLC with the appropriate Modbus master functions and define the data to be read by the master. Ensure that the communication parameters (baud rate, data bits, stop bits, and parity bits) for both the PLC and flow meter match. 
 
電腦操作示意圖
The flow meter transmits data to the PLC via the RS485 interface, where the PLC reads the data using the Modbus RTU protocol. The data from the flow meter is then displayed in real-time on a computer monitoring interface, showing a curve of the flow readings.
In Modbus RTU communication, a Modbus packet includes the address field, function code, data field, and error-checking code (CRC check). TX represents the transmitted request signal, while RX is the response signal.
TX request signal TX 01 04 00 64 00 01 70 15
01:Slave address.
04:Function code (for reading input registers).
00 64:Register address (address 100).
00 01:Number of registers to read (1 register).
70 15:CRC check code for data integrity.
RX response signal RX 01 04 02 04 00 BB F0
01:Slave address, indicating the response is from the device at address 1.
04:Function code, confirming it’s a "read input registers" response.
02:Data length, indicating 2 bytes of data.
00 BB:Data value, a 16-bit number. In hexadecimal, 00BB converts to the decimal value 187.
F0:CRC check code, verifying the packet's integrity.
These flow data can also be converted by a gateway to other protocols (e.g., Modbus TCP) or physical layers (e.g., Wi-Fi) and transmitted over Ethernet to a remote server for cloud storage. This enables remote monitoring of production status and automated data reporting. For instance, if abnormal flow data is detected, the system can automatically send alerts via a notification system, enhancing production efficiency and facilitating convenient management.
[8]

References

  1. ^ 帶你認識物聯網 Modbus 通訊協議-WARREN LO
  2. ^ Modbus协议的通信方式有几种 - 小頭菜
  3. ^ Understanding Modbus Protocol - RTU vs TCP vs ASCII - OPS Telecom
  4. ^ Modbus RTU 通訊協定介紹 - 力誠科技
  5. ^ Modbus RTU簡介(上) - iT 幫幫忙
  6. ^ Modbus协议数据类型只有这四种 - 小頭菜
  7. ^ MODBUS 位址加40001 / 30001,為什麼就可以不用輸入功能碼? - PLC
Products you may also like
Related articles

Contact Us