Volume9•Issue5 SEPTEMBER–OCTOBER 2008

© 2008 Contemporary Control Systems, Inc. Introduction to Modbus Serial and Modbus TCP By George Thomas, Contemporary Controls In this second part of a two-part series on Modbus, we will discuss two implementations of the Modbus Protocol that were introduced in our previous article. The first implemen- tation is the traditional implementa- tion of Modbus over a serial line. The second implementation is more Table 1. Modbus over Serial Line uses a three-layer model. modern with Modbus operating over instead, the model relies on the subset of all the available function a TCP/IP network. Both implementa- to ensure end-to- codes. The data structure may tions remain popular. end delivery of a message. The data change depending upon the function Modbus over Serial Line link (layer 2) is occupied by the code. Wrapping the Modbus PDU is Modbus Serial Line Protocol. Finally, an address field and an error check Modbus.org has released a Modbus the (layer 1) allows field. The address field only contains over Serial Line Specification and for either the EIA-232C or EIA-485 slave addresses or the broadcast Implementation Guide V1.02 that implementation. With only three address. The master address is not provides guidance when using layers, Modbus over Serial Line is required and not referenced since Modbus with serial links. As easier to understand than other this is a master/slave protocol with mentioned in our previous article, industrial protocols. Since the commands originating from a Modbus was originally intended to Modbus Application Protocol was unique master. be used with point-to-point EIA-232C discussed in part 1, it will not be As mentioned in part 1, the actual interfaces with the master being a repeated here. Instead, only the Human Machine Interface (HMI) and framing of Modbus over Serial Line data link and physical layers will messages depends on whether ASCII a PLC as the slave. Multiple slaves be discussed. connected to one master would then or RTU transmission mode is used. require multiple links which is Data RTU is the most popular mode and is shown in Figure 2. It is a very inconvenient and expensive. It Much about the Modbus over Serial compact with only one byte would be only natural to change the Line (PDU) was reserved for the slave or broadcast point-to-point link to a multipoint mentioned in part 1 but will be address, one byte for the function serial infrastructure such as EIA-485 summarized below. Referring to code and two bytes for the CRC which would allow one master to Figure 1, note that the PDU consists communicate to multiple slaves over a common serial line. This approach is encouraged in the Modbus.org document, but not mentioned in the original Modicon Modbus Protocol Reference Guide. Three Layer Model Figure 1. A slave address field and error check wrap around a Modbus PDU. error check. A single byte carries the Instead of the traditional seven-layer of four elements. In the middle is function code. Notice that there is ISO Open Systems Interconnection the Modbus PDU consisting of a no end-of-frame sequence. With Reference Model, the Modbus over function code and data. Most RTU, end-of-frame is indicated by Serial Line model is collapsed to Modbus implementations only use a three layers as shown in Table 1. At 3.5–4.5 character times of silence. the top is the application layer that was discussed in part 1. This is called the Modbus Application Protocol or simply the Modbus Protocol. Layers 3–6 are not used — Figure 2. RTU framing is more condensed than ASCII framing.

(No part of the Extension may be reproduced without the written consent of Contemporary Controls.) 1 The largest frame occupies only 256 EIA-485 standard — supporting up Line polarization is used to force the bytes. With RTU each byte is sent to 32 devices over a common . bus into a known state when no using 11 bits. Each data character This can be implemented with either drivers are active. EIA-485 receivers requires eight bits. There is one start- a two-wire or four-wire cabling require a 200 mv failsafe bias to bit, one stop-bit and one parity-bit. If configuration. With any of the serial ensure they detect a floating line as parity is not used, another stop-bit is line implementations, a wide range an “off” state. This is why line sent in its place. If parity is employed, of baud rates from 1.2 kbps to 115 polarization is typically referred to as it can be odd or even. kbps are allowed, but all implemen- failsafe bias. At each end of the bus The ASCII message format in Figure tations must at least support 9.6 kbps are line terminators (LT) to match 3 requires two bytes for the slave and 19.2 kbps. The default rate is the natural impedance of the bus. address as well as for the function 19.2 kbps. The pull-up and pull-down resistors interact with the two termination resistors to create the failsafe bias. The Modbus over Serial Line specification recommends that the pull-up and pull-down resistors have Figure 3. ASCII framing requires start-of-frame and end-of-frame characters. values between 450 and 650 ohms, code. Unlike RTU, the ASCII frame Two-Wire Network and that only one network is used. uses a two-byte LRC for the error This assumes that failsafe bias is Figure 4 shows a recommended two- check field. The advantage of the needed at all. Some transceivers wire interface for EIA-485 networks ASCII format is that it is human have built-in bias so external bias is with applied line polarization. As readable. Notice that there is an not needed. expected, there is one master trans- end-of-frame sequence composed of ceiver and multiple slave transceivers Four-Wire Network carriage return and line feed (CR,LF). connected to a common 2-wire bus Inter-frame spacing is not critical. Figure 5 shows a recommended with the wires labeled D1 and D0. Data is represented as a hexadecimal four-wire interface still using EIA-485 value coded as ASCII. Therefore, At a minimum, a total of 32 devices devices. The transmitter of each only 7 bits are required for every must be supported. With a 2-wire device is separated from the device’s ASCII character, but two characters bus, the output of the transmitter is receiver. The master has its transmitter are required for each byte of data. directly tied to the input of a receiver connected to all the slaves’ receivers One start-bit and one stop-bit are at each device. Even though this is while all the slaves’ transmitters are used. If a parity-bit is used, either called a 2-wire bus, there is a connected to the master’s receiver. odd or even parity can be sent. If no common reference connection Failsafe bias and termination are still parity is sent, then another stop-bit is labeled common. Each device must used — but their requirements are sent. This means each byte in ASCII share its common with all other doubled in a four-wire network. is sent as 10 bits. devices on the bus to ensure that the Even the four-wire arrangement requires a “fifth” wire and that is the common. Although the Modbus over Serial Line specification supports both a 2-wire and 4-wire arrangement, the 2-wire implementation is the most popular. Although it is possible to have a full-duplex link with 4 wires, the Modbus protocol is strictly half- duplex. The master imitates commands to a particular slave while awaiting the slave’s response. This is handled quite effectively with a Figure 4. A two-wire serial line implementation actually requires three wires. 2-wire implementation.

Physical Layer maximum common-mode voltage The original Modbus protocol called rating of the device is not exceeded. for a point-to-point EIA-232C link The line polarization network between a host and a PLC. (consisting of a pull-up and pull- This option remains today. But the down resistor) is shown near the Modbus over Serial Line specification master, but its location is not a encourages the use of the multipoint requirement — only a recommendation.

2 Another significant change (shown in Figure 6) is that the Modbus bus is actually an IP bus. The physical and data link layers are not specified. Instead of having one master attached to multiple slaves, the terms client and server are used. Clients could be HMIs or PLCs, while servers could be input/output racks. Like a master, clients initiate commands to a server. Like a slave, servers respond to client commands. However, the proper terminology with client/server communications is that clients initiate requests with servers providing responses. It is actually a bit more involved than that. Figure 5. A four-wire serial line implementation actually requires five wires. * A Request is sent by the client to Modbus TCP model was used for Modbus TCP as shown in Table 2. Instead of a long initiate a transaction. The Modbus protocol continues to discussion on physical and data link * An Indication is sent by the survive in an automation world layer issues, the standard only needs server to confirm that a request more interested with connecting to to point to the 1500 page IEEE 802.3 was received. networks and more standard. There is no mention of specifically, IP/Ethernet networks. * A Response is sent by the server how to physically attach stations or Modbus.org authored the to comply with the client request. what cabling or connectors to use. * A Confirmation is sent by the client to acknowledge receipt of the response. What is significant in this model is that several clients can reside on the IP network and access a common set of servers. This is a fundamental change in how the Modbus protocol Table 2. Modbus TCP uses a five-layer Internet model. works. There is no single master Modbus Messaging on TCP/IP This messaging standard only talks controlling a defined set of slaves. Implementation Guide V1.0b for this about how a Modbus PDU very purpose. Instead of a three-layer (consisting of a function code and model that was used for Modbus data) is encapsulated into a higher over Serial Line, a five-layer Internet level protocol.

Figure 6. Instead of using master and slaves, the Modbus TCP model uses clients and servers.

3 Any number of clients can access Identifier provides the address of a References any number of servers. Is it possible Modbus Serial Line slave that must Modbus Application Protocol to have conflicts with clients making be accessed through a gateway. Specification V1.1b, contradictory requests of a particular With Modbus TCP clients and http://www.Modbus-IDA.org, server? Yes, that is the risk this model servers, station addressing occurs by December 28, 2006 presents with its newly gained flexibility. using IP addresses. However, if a The MBAP Header Modbus slave is attached to a serial line, the actual slave address needs Modbus over Serial Line Specification Figure 7 shows how a new Modbus to be specified. The gateway address and Implementation Guide V1.02, TCP/IP Application Data Unit (ADU) would then be an IP address. In http://www.Modbus-IDA.org, is formed. The traditional Modbus order to send the ADU over TCP, a December 20, 2006 PDU of the Modbus over Serial Line registered TCP port number must be method is still present. The function used. Modbus.org registered port code and data definitions remain 502 for this purpose. Modbus Messaging on TCP/IP intact. What is appended to this PDU Implementation Guide V1.0b, http://www.Modbus-IDA.org, October 24, 2006

Modbus Protocol Reference Guide Rev. J, http://www.Modbus-IDA.org, Figure 7. The Modbus Application Protocol header is added to the Modbus PDU. June 1996

Figure 8. The MBAP header is seven bytes long. is a Modbus Application Protocol Summary (MBAP) header, details of which are Modbus is popular for its simplicity. shown in Figure 8. The Transaction Because so many users with Modbus Identifier is supplied by the client knowledge are in the field and and used to keep track of specific because a Modbus-IDA association requests. The server is to send back backs this open standard, it will the same identifier with its response. continue to remain popular. The client is allowed to send multiple requests to a server without waiting for individual responses. The Protocol Identifier would allow support for multiple protocols. For Modbus the value is zero. The Length field identifies the length of all remaining fields including the Modbus PDU fields. Finally, the Unit

www.ccontrols.com

Past issues of the copyrighted Extension are available. Please visit our web site www.ccontrols.com. Select Support and click on Extension Archive.

4