1. What is Modbus - How does Modbus work?
Modbus transfers data through several wires between devices, where the simplest setting is to connect the master and the slave with a serial cable. Data are transferred as a string of 0 or 1, and a digit is a bit. 0 represents a positive voltage while 1 is a negative voltage. The bit data transmission speed is very fast, and the common transmission speed is 9600 baud (i.e. 9600 bits/s).
2. What is Modbus - How to store data in standard Modbus?
The information is stored in four different tables in the slave. Two tables store digital quantities, called coils; another two tables store analog quantities, called registers. As for the coil and the register, one can be read only while the other one can be read and written. Each table can store 9999 values. The coil is in one bit and the address are from 0000 to 270E; the register is in one word (16 bits, 2 bytes) and the address are also from 0000 to 270E.
|
Coil/Register Numbers |
Data Addresses |
Type |
Table Name |
|
1-9999 |
0000 to 270E |
Read-Write |
Discrete Output Coils |
|
10001-19999 |
0000 to 270E |
Read-Only |
Discrete Input Contacts |
|
30001-39999 |
0000 to 270E |
Read-Only |
Analog Input Registers |
|
40001-49999 |
0000 to 270E |
Read-Write |
Analog Output Holding Registers |
The number of Coil/Register can be regarded as the name of the address, and they do not appear in the actual sent message. Data Address are in the actual sent message.
For example, the number of the first Holding Register is 40001, and its data address is 0000. The difference between these two numbers is because of the offset.
3. What is Modbus - What is the slave ID?
In the network, each slave is assigned a unique device address, which ranges from 1 to 247. When the master requests data, the first byte of the sent message is the slave address. In this way, after receiving the first byte, the slave will know whether it needs to ignore the subsequent information.
4. What is Modbus - What is a function code?
The second byte sent by the master is the function code. This function code tells the slave which table needs to be accessed, whether to write data to the table or read data from the table.
|
Fun Code |
Action |
Table Name |
|
01(01 hex) |
Read |
Discrete Output Coils |
|
05(05 hex) |
Write single |
Discrete Output Coil |
|
15(0F hex) |
Write multiple |
Discrete Output Coils |
|
02(02 hex) |
Read |
Discrete Input Contacts |
|
04(04 hex) |
Read |
Analog Input Registers |
|
03(03 hex) |
Read |
Analog Output Holding Registers |
|
06(06 hex) |
Write single |
Analog Output Holding Register |
|
16(10 hex) |
Write multiple |
Analog Output Holding Registers |
5. What is Modbus - What is CRC?
CRC stands for Cyclic Redundancy check, which is adding two bytes after each message sent to check whether there is an error in sending or receiving. Each byte of the message is used to calculate the CRC. The receiver calculates the CRC while receiving the data. And then, it compares the calculation result with the CRC calculated by the sender. If the two are different, an error occurs.
6. What is Modbus - Format of Modbus command send and response
|
Data Addresses |
Read |
Write Single |
Write Multiple |
|
Discrete Output Coils 0xxxx |
FC01 |
FC05 |
FC15 |
|
Discrete Input Contacts 1xxxx |
FC02 |
NA |
NA |
|
Analog Input Registers 3xxxx |
FC04 |
NA |
NA |
|
Analog Output Holding Registers 4xxxx |
FC03 |
FC06 |
FC16 |
Note: FC stands for Function Code
Example:
Data request:
11 01 0013 0025 0E84
11: Slave address (0x11 = 17)
01: Function code 01 (Read coil status)
0013: First address of coil (0x0013=19, +1 Offset=#20 coil)
0025: Number of coils to be read (0x25 = 37, 20~56)
0E84: CRC
Data Response
11 01 05 CD6BB20E1B 45E6
11: Slave address (0x11 = 17)
01: Function code 01 (Read coil status)
05: Number of bytes after (37/8=5 bytes)
CD: Coil 27-20 (1100 1101)
6B: Coil 35-28 (0110 1011)
B2: Coil 43-36 (1011 0010)
0E: Coil 51-44 (0000 1110)
1B: 3 spaces and coils 56-52 (0001 1011)
45E6: CRC
