Modbus

Page Contents

References

Brief Intro

  • Application layer messaging protocol,

  • Request / reply protocol, services specified by function codes,

  • Simple PDU (protocol data unit):

    • 1-byte function code, followed by data: {Function Code | Data}
    • Built by client, sent to server,
    • Max size = 256 bytes - server address (1 byte) - CRC (2bytes) = 253 bytes,
    • Function tells server what action to perform,
    • Three types:
      • MODBUS request - mb_req_pdu = {function_code, request_data},
      • MODBUS response - mb_rsp_pdu = {function_code, response_data} - Normal server response echoes function code back,
      • MODBUS exception response - mb_excep_rsp_pdu = {exception-function_code, exception-code} - Exception response echoes function code | 0x80. Exception code is one of:
        0x01Illegal function
        0x02Illegal data address
        0x03Illegal data value
        0x04Slave devuce failure
        0x05Acknowledge
        0x06Slave device busy
        0x07n/a
        0x08Memory parity error
        0x09n/a
        0x0AGateway path unavailable
        0x0BGateway target failed to respond
    • In PDU each data item address from 0 to 65535,
  • ADU (application data unit):

    • Wraps a PDU : Additional address | PDU | Error check = Additional address | Function Code | Data | Error check,
    • Adds an address prefix and a CRC suffix,
    • Lets MODBUS work on specific busses,
  • Big endian,

  • Data model based on "tables", which are essentially registers of which there ar 4 types:

    • Discrete inputs - RO single bits,
    • Coils - RW single bits,
    • Input registers - RO 16-bit words,
    • Holding registers - RW 16-bit words,

    "Tables" can overlay eachother or not,

    For each table, protocol allows individual selection of 65536 data items,

  • Function codes:

    • Public:
      • Well defined and guaranteed unique,
      • Validated by MODBUS-IDA,
      • Conformance test available,
      • 1 - 64
    • User definded:
      • No guarantee of uniqueness,
      • 65 - 72 or 100 to 110
    • Reserved

Some Public 16-bit Access Tables

A summary of some of the most common 16-bit tables (read registers):

Read Holding Registers 0x03
  • Request:
    Function code1 byte0x03
    Start address2 bytes
    Num registers2 bytes0x0001 to 0x007D
  • Response:
    Function code1 byte0x03
    Byte count1 byte2N
    Register value2N bytes
  • RError:
    Error code1 byte0x83
    Exception code1 byte1, 2, 3 or 4
Read Input Register 0x04
  • Request:
    Function code1 byte0x04
    Start address2 bytes
    Num registers2 bytes0x0001 to 0x007D
  • Response:
    Function code1 byte0x04
    Byte count1 byte2N
    Input registers2N bytes
  • RError:
    Error code1 byte0x84
    Exception code1 byte1, 2, 3 or 4
Write Single Register 0x06
  • Request:
    Function code1 byte0x06
    Register address2 bytes
    Value2 bytes
  • Response:
    Function code1 byte0x06
    Register address2 bytes
    Value2 bytes
  • RError:
    Error code1 byte0x86
    Exception code1 byte1, 2, 3 or 4
Write Multiple Register 0x16
Read/Write Multiple Register 0x23
Mask Write Register 0x22
Read Exception Stats 0x07
Diagnostic 0x08 Subcodes 0x00-0x18, 0x20

Nice YouTube Tutorial