Modbus

Industrial Communication

Chapter 2: Modbus Serial

2Industrial Communication Course with Unity Pro - Modbus

Schneider Electric | Industry Business | Training | E. Pauchet – V5.0 – May 2010

Modbus Serial Features



Introduction

●Modbus = Modicon Bus (1979)

● is an application layer messaging protocol for client/server communication

between devices connected on the bus.

● Independent from the other layers

● Openly published and royalty-free

● Relatively easy industrial network to deploy

● It moves raw bits or words without placing many restrictions on vendors

●Various versions

●Modbus RTU (Serial), Modbus ASCII, Modbus Ethernet TCP/IP, Modbus

Plus (Proprietary of =S=)



Layers Used in ISO Model

●3 Layers used for Modbus Serial

RS485, RS422, Fiber Optic, Radio, Cellular, …PHYSICAL

Master / Slave, Transmission RTU / ASCIIDATALINK

Not usedNETWORK

Not usedTRANSPORT

Not usedSESSION

Not usedPRESENTATION

Modbus ProtocolAPPLICATION



Physical Layer

RS485 2 wireMulti-point and

point-to-point

RS485 4 wire

RS232

Required

Optional

Optional

To integrate into an

existing installation

without modification

Point-to-point mode

15 meter max.

Transmission speeds:

9600 bps and 19200 bps required with 19.2 Kbps by default

Other speeds: 1200, 2400, 4800, 38400, 56 Kbps, 115 Kbps optional

RS485 is the most common physical layer used on Modbus. 32

devices included the master can be connected on the bus.



Modbus RS485 4 wire installation

Slave 1

TR

Slave n

TR

Slave pair

Master pair

Common

Master

RT

5 V

5 V

650 ohms

650 ohms

Topology: bus type

120 ohms

1 nF

120 ohms

1 nF

120 ohms 1 nF

120 ohms 1 nF

PG

Max. length: Main segment: 1,000 m at 19,200 bits/sDrops: 40 m in total (20 m for one tap link)

Max. number of devices:32 including master without a repeater



Modbus RS485 2 wire installation

Common

Balanced pair

Slave 1

TR

Slave n

TR

5 V

650 ohms

650 ohms

Master

RT

Topology: bus type

Max. length: Main segment: 1,000 m at 19,200 bits/sDrops: 40 m in total (20 m for one tap link)

Max. number of devices:32 including master without a repeater

120 ohms

1 nF

120 ohms

1 nF

PG



Data Transmission

●Method of accessing the medium

●Master slave

●Transmission method:

●Client / Server

●Max. useful data size:

● 120 words



Unicast Addressing Mode

Adr 1 Adr 2 Adr 3 Adr 4 Adr 5 Adr n

Address = 1 to 247

RequestFunct.

CodeRequest data5 CRC

ResponseFunct.

CodeResponse data5 CRC



Broadcast Addressing Mode

Adr 1 Adr 2 Adr 3 Adr 4 Adr 5 Adr n

No response from slaves

RequestFunct.

CodeRequest data0 CRC

Used only with write functions

Address = 0



Transmission Modes

●ASCII transmission mode

●Every data item is encoded in two ASCII characters (7 bits)

● allows time intervals of up to 1 second to occur between characters without

causing an error.

●Used with Modem / Barcodes

● RTU transmission mode

●Every data item is encoded in one byte (8 bits)

●Achieves higher throughput & reliability

●Used with PLC / SCADA



Modbus Serial Frame

Function

CodeDataAddress CRC or LRC

Additional data depending

on the Function Code= 0 to 247

Identifies the

addressee

Validity

check

= 1 to 127

Action to

perform

Modbus PDUPDU = Protocol Data Unit

Two

addressing

modes:

Unicast

Broadcast

Address field = 1 to 247

Address field = 0

(used in write only mode)



Address Field

Address ChecksumDataFunction

Valid device addresses : 0 to 247 decimal. Value 0

reserved for broadcast message (no reponse)

●Request

●A master addresses a slave by placing the slave address in the address

field of the message.

●Response

●When the slave sends its response, it places its own address in this address

field of the response to let the master know which slave is responding.



Function Field

●Request

● The function code field tells the slave what kind of action to perform.

●Response

● For a normal response, the slave simply echoes the original function code.

● For an exception response, the slave returns a code that is equivalent to the

original function code with its most significant bit set to a logic 1.


Valid codes are in the range of 1

to 255 decimal.



Data Field

●Request

● The data field contains additional information which the slave must use to

take the action defined by the function code. This can include items like

register addresses, quantity of items to be handled, etc...

●Response

● If no error occurs, the data field contains the data requested.

● If an error occurs, the field contains an exception code that the master.

Application used to determine the next action to be taken.




Checksum Field

●Modbus RTU uses CRC

●Cyclical Redundancy Check (2 bytes)

●Modbus ASCII uses LRC

● Longitudinal Redundancy Check (1 byte)

●Request

● The checksum is calculated by the master and sends to the slave.

●Response

● The checksum is re-calculated by the slave and compared to the value sent by the master. If a difference is detected, the slave will not construct a response to the master.




Function Codes

Code Function

01 (0x01) Read n consecutive output bits

02 (0x02) Read n consecutive input bits

03 (0x03) Read n consecutive output words

04 (0x04) Read n consecutive input words

05 (0x05) Write 1 output bit

06 (0x06) Write 1 output word

07 (0x07) Read exception status

08 (0x08) Access diagnostic counters

15 (0x0F) Write n output bits

16 (0x10) Write n output words

23 (0x17) Read/Write n output words

43 (0x2B) Read identification

http://www.modbus.org



Example of Read Request

Request

Slave

AddressCRC16

First word

address

Function

code = 3

Number of

words to read

1 byte 1 byte 2 bytes 2 bytes 2 bytes

Response

Slave

AddressCRC16

Number of

bytes read

Function

code = 3

Value of the

first word

1 byte 1 byte 2 bytes 2 bytes 2 bytes

Value of the

last word

2 bytes



Registers & Index

●Registers

●Memory variable located in a device

●Word, Bit, Byte, etc…

●Can be reached thanks to its Index

● Inputs Registers: read only (status)

●Outputs Registers: read / write (commands)



Programming Modbus with Unity Pro



1 Platform, 3 Target

●3 PLC Targets

●M340, Premium, Quantum

●Same Philosophy

●Different Function Blocks



BMXNOM0200

●Safety screw (1)

●Display block with 4 LEDs: (2)

●RUN (green) and ERR (red): Module status

●SER COM (green): Activity on the serial link (lit) or

fault (flashing).

●Channel 0 (3a & 3b)

●RS 232C connection, marked COM Port 0 RS232

●RS 485 connection, marked COM Port 0 RS485

●Channel 1 (4)

●RS 485 connection, marked COM Port 1 RS485



BMXNOM0200 Configuration



Request Programming

●Dedicated Function Blocks for M340

●ADDM

●Address Conversion

●READ_VAR

●Execute a read request

●WRITE_VAR

●Execute a write request

●DATA_EXCH

●Execute a user defined request

●OUT_IN_MBUS

●Change from Slave to Master mode



ADDM FB

● IN:

●String variable: ‘r.m.c.e.MBS’

●Out

●Converted table of words, to be used in the others FB

● ‘r.m.c.e.MBS’

● r = the rack number where the Modbus module is located,

●m = the slot number of the Modbus module,

● c = the channel used

● e = the equipment address (slave address) of the target

● “MBS” = used to indicates to use Modbus Serial (optional)



READ_VAR FB

● IN:

●ADR: to be linked to the output of the ADDM block.

●OBJ: defining object to read (in the case of Modbus register: ‘%MW’)

●NUM: starting register to read

●NB: number of consecutive register to read

●OUT

●RECP: reception zone of the block, delivering the value read (table of

words)

● IN/OUT

●GEST: table of 4 words to manage the communication block (errors,

timeout, length, etc..)



WRITE_VAR FB

● IN:

●ADR: to be linked to the output of the ADDM block.

●OBJ: defining object to read (in the case of Modbus register: ‘%MW’)

●NUM: starting register to read

●EMIS: source table to write from the PLC

● IN/OUT

●GEST: table of 4 words to manage the communication block (errors,

timeout, length, etc..)



GEST Variable

●Structured Variable

● Table of 4 words

LengthGEST[4]

TimeoutGEST[3]

Communication ReportOperation reportGEST[2]

Activity bit: 1 = exchange in

progress, 0 = exchange

terminated.

Exchange number (updated

each time the request is

executed)

GEST[1]

Least Significant ByteMost Significant Byte



Exercise

●Add & Configure Modbus Module (p 2-13)

– Add a module

– Configure the channel

– Set the Modbus Slave

– Insert the ADDM block

– Create the READ_VAR request

– Test the application



Optimizing Communication

●Beware of Communication Buffer Overload

●Usage of the Activity Bit (GEST[1].X0)



Optimizing Communication (Example)

●Conditioning with the Activity Bit

●Avoid buffer overload

●Ensure that the next block is send when the previous is finished.



Optimizing Communication (Cont.)

●Device Timeout

●Mean to know if the Master is lost

●After a defined time without receiving request, Slave goes to fallback mode

●Fallback Mode

●Mode activated when communication is lost

●Behaviour to define (start a motor, stop a process, switch off outputs..)

Allo, anybody

still there?

No answers…

great, let’s go

party!



Exercise

●Optimizing the Communication (2-16)

– Insert the Activity Bit as condition

– Insert the WRITE_VAR function

– Test the communication

●Testing the TimeOut (2-20)

– Use WRITE_VAR to change the Timeout parameter

– Test the communication



Modbus Serial RTU

●Main Features Reminder:

●Up to 1200m whatever the baud rate value

●Performance: Depends on the PLC application and how it’s managed.

●Up to 32 Slaves

●Baudrates: 1,2kbit/s... 19,2kbit/s

●max 240 bytes per telegram

●No separate ground wire

●Good error detection (CRC)

Date post:	26-Oct-2014
Category:	Documents
Upload:	dragon184
View:	254 times
Download:	7 times

Modbus

Documents