Basics of Communication Modbus training

What is Modbus ?
• An open data communication protocol
• Published by Modicon
• http://www.modicon.com
• Open structure
• Flexible
• Widely known
• Supplied by many SCADA and HMI software
• 2 serial transmission modes:
– ASCII  10 bits
– RTU (Binary)  11 bits
• Communication interface
– RS-232/485
– Ethernet (TCP/IP)
• Modbus Organization (http://www.modbus.org/default.htm)
P.2

Types of Modbus:
• A leading industrial open control protocol.
• Several different types, depending upon the transported media
• Modbus RTU - Original Modbus used over RS-232 and RS-485
• Modbus ASCII - Similar to Modbus RTU, data is in ASCII instead
of raw binary. This version is mainly used over radio links.
• Modbus/TCP - Used over Ethernet - similar to Modbus RTU, but
uses the Ethernet check-sum rather than the RTU check sum.
• Modbus over Ethernet - This is a vague term used by some vendors,
but is not an officially recognised name. It is often used to refer to
tunnelling Modbus RTU over Ethernet between two points using
special hardware. Not part of the Modbus standard
• Modbus/UDP - similar to Modbus/TCP but uses UDP Ethernet
sockets instead of TCP sockets. not part of the Modbus standard.
• Modbus+ - This is a proprietary protocol doesn't follow the Modbus
communications standard. This is rarely encountered.
P.3

Modbus Types of communication
• Modbus serial
1) Modbus on RS232(EIA/TIA-232)
2) Modbus on RS422
3) Modbus on RS485(EIA/TIA-485)
4) Transfer method : RTU/ASCII
RTU(Remote Terminal Unit)
ASCII
(American Standard Code For Information
Interchange)
• Modbus plus
• Modbus TCP/IP

Modbus protocol &
system application
Modbus serial

Modbus Serial Features I
1. Master-Slave Protocol
-Master: At the same time, only one can be connected only
-Slave : Up to 247 can be connected to
2. Master Request 2 modes
-Unicast mode
Master: request(Query)
Slave : reply(Response)
Address: 1 ~ 247
-Broadcast mode
Master sends a Request to all Slaves
Address: 0
3. Address : 248 ~ 256(reserved)

Modbus Serial Features II
4. Communication speed
1200, 2400, 4800, 9600, 19200 bps, 56Kbps, 115.2kbps
5. Max communication distance: 1000 m
6. Termination: 150 Ohms / 0.5W
7.1979 years developed by Modicon
8. Token passing by way communication

General communication frame
• (header) : in front of the data field
– flag, address, control field
• (trailer) : located behind data field
– FCS and Flag
• (frame check sequence : FCS)
Flag Address Control FCS Flag
trailer
header
Data

Modbus Serial
Modbus Frame
- PDU : Protocol Data Unit
- Address Field : Slaves Address
- Function Code : Indicating the command code is performed
- CRC/LRC : Frame Error Check

Modbus Serial
RTU(Remote Terminal Unit) Mode

Modbus Serial
ASCII Mode(Frame inside the characters that apply)
FRAME ERROR CHECKING
1. CRC (Cyclical Redundancy Checking) => RTU
2. LRC (Longitudinal Redundancy Checking)=>ASCII

Modbus Frame
(0x02) Read Discrete inputs

Modbus Frame
(0x03) Read Holding Registers

Modbus transaction(exception response)

Modbus Master AutoSense Feature
Master
Query
Response
XMIT
Not Enabled
Slave

Modbus Master AutoSense Feature
Query
Response
Query
Response
Active
XMIT
Complete
Master
Slave

Modbus Plus Frame
PREAMBL
E
OPENIN
G FLAG
BDCST
ADDRES
S
MAC / LLC FIELD CRC
CLOSIN
G FLAG
DEST
ADDRES
S
SOURCE
ADDRES
S
MAC
FUNCTIO
N
BYTE
COUNT LLC FIELD
OUTPUT
PATH
ROUTER
COUNTE
R
TRANS
SEQUENC
E
ROUTING PATH MODBUS
FRAME(MODIFIED)
SLAVE
ADDRES
S
FUNCTION
CODE
STARTING
ADDRESS HI
STARTING
ADDRESS
LO
NUMBER OF
REGISTER
HI
NUMBER OF
REGISTER
LO
HDLC LEVEL
MAC LEVEL
LLC LEVEL
MODBUS MESSAGE

The flexibility of Modbus Plus
1. Data Communications
- Modbus Application solution to enhance more
- High-speed connectivity of the host, and improved
operator system
- Event handling of peer to peer communication
-Controller for distributed control interlock between
the easy and reliable
- Bridges and repeaters can be configured in a
flexible
- Schneider's products and products with a variety
of connectivity
2. Programming
Program to upload, download and can be Verify.
- The network connection is available in the eight
programmer productivity was increased.

Modbus Plus System
Single network with dual cabling, all network traffic is carried
over both cables simultaneously
Available on
Standard on Quantum CPU controller
Quantum and NOM modules
Quantum DIO adapters
AT and VME bus adapters
Some PanelMates
Bridge Multiplexer and Bridge Plus
Excellent for process and safety
critical applications
Cable A
Cable B
Bridge
Plus
Single cable
Modbus Plus
Network
Dual cable
Modbus Plus
Network

Modbus protocol &
system application
Modbus TCP/IP

Modbus TCP/IP ADU
- ADU : Application Data Unit
- PDU : Protocol Data Unit
- MBAP : Modbus Application Protocol
- Function Code :What kind of a code indicating the
command is performed

SERVER/CRIENT MODEL
SERVER
CLIENT1 CLIENT2
REQUEST
CONFIRMATION
REQUEST
CONFIRMATION
RESPONSE
INDICATION
MODBUS TCP/IP
CLIENT3
TCP/IP TO MODBUS PLUS

• Communication Settings
- Modbus message, the program performs a new
communications link for exchanging data with other
devices in order to Port no 502 should provide a listening
socket.
- The local port must be greater than 1024 and each one
client to another are Different.
- Connecting the client and the server exceeds the number of
allowable features
Has not been used for a long time, it is the most closed.
Two. Communications closing (Closing)
- The communication between the client and the server, the
client ends
Was used to initiate the connection to close the connection.
Communication on and off

Modbus TCP/IP Features
1. Slave address field of a Modbus Serial line on the MBAP
Header Located in the unit identifier is replaced by a single
byte.
2. Unit identifier is to support multiple independent Modbus unit
Using the IP address of one of the bridges, routers, and devices
such as gateways are used to communicate.
3. Modbus requests and responses are all recipients of the
message Ended been designed so that they can be confirmed.
4. To be performed on Modbus TCP when the length of the
accompanying information Recipient of the message is
unknown, so the range is performed at MBAP.
5. CRC-32 error check code is used.
6. All Modbus / TCP ADU are a registed port 502 over TCP
Sent.

Modbus TCP/IP mFeatures
Transmission Control Protocol - TCP
HTTP SMTP
Web
server
e-m@il TCP
open Modbus
Message
I/O
Scanner
 Modbus TCP
Read and write data
Update I / O
Benefit: Modbus Device connectivity with the
other is easy. Host computers and OPC servers
directly, without the PLC to communicate with
other devices can send and receive. .
Transparent link to Modbus Serial Devices
Results: The cost is reduced. (Special
equipment is not needed).
Simply build a communication system.

Modbus TCP/IP Features
“ Modbus Accepted as Chinese
Standard”
“ Modbus TCP Accepted as
IEC
Publicly Available
Specification”
“ ARC Advisory Study
Places
Modbus TCP in the Lead”
• MODBUS ® is the world's most
widely used industrial protocol.
Modbus Ethernet (Modbus TCP) is
the best of the Industrial Ethernet.
By Modbus-IDA is a free, open
protocols.
Communication system, which is
easy to use, simply
Independent media; Ethernet, RS-
232/485 serial links, wireless, fiber
optic, radio, cellular, etc.
There are hundreds of MODBUS
device.
Modbus is a industrial protocol (IP)
standard to comply with. (Port 502)

Modbus protocol &
system application
SYSTEM APPLICATION

Quantum Hot Standby, the ultimate in high
availability
Cable A
Cable B
Dual cable
Modbus Plus
Network
Dual cable
Remote
I/O
Network
Fiber
Optic
CHS
Link
Cable A
Cable B
TCP/IP Ethernet
To Modbus Plus
Bridge
TCP/IP
Ethernet
 Redundant
CPUs140cpu671 60
Remote I/O
processors
Hot standby
processors
 Redundant cabling
Modbus Plus
Remote I/O
 Redundant power
supplies
Primary and standby
controllers
Remote I/O drops
 Fiber optic CHS
processor link

Electrical Utility Infrastructure
Complete Substation Data Hub
Multi - vendor communications support
9
I1 133 A
I1 133 A
I1 133 A
POWER
b
b
Bitronics, Inc.
Lehigh Valley, Pa
Made in USA
CURRENT INPUTS
VOLTAGE INPUTS POWER
PowerPlex
Digital transducer
POWER STATUS
HI
LO
IA IB IC
....
.....
Protocol Gateway (Loadable)
and /or Internet/Intranet
Local or remote access
to all Substation IEDS
E
C
NORMAL
FAIL
PICKUP
RECLOSER OUT
SYSTEM RESET
TIME
INSTANTANEOUS
FREQUENCY
NEGATIVE SEQUENCE
TARGET RESET
STATUS TARGETS
A
B
C
N
DPU
2000R
Network
Partner
V1.0
Direct MB+
Devices
Modicon NW BM85D002 BRIDGE MUX
9
Doble
Modem
Modicon NW BM85D002 BRIDGE MUX
DNP 3.0 Gateway
L&G 8979 Gateway
ABB or Schweitzer
Modbus
DNP 3.0
Gateway
Cooper
Gateway

Modbus TCP/IP
Electrical Distribution
 Reducing energy costs
 Increasing energy availability
and quality
 Optimizing electrical equipment
utilization
Automation & Control
 Ingenuity of collaboration
 Openness of Ethernet TCP/IP
universal network
 Simple HMI, with Web
technologies
 Ethernet TCP/IP and Web technologies
 Modbus, industrial & Internet standard
 Openness and partnership

Application Structure (general)
P.42
Modbus Device (Slave) Modbus Device (Slave)
Internet
RS-232/485
HMI
SCADA
Modbus Client (Master)

Query-Response Cycle
P.43
Station Number
Data Bytes
(Flexible)
Error Check
Station Number
Function Code
Data Bytes
(Flexible)
Error Check
Query
Response
Function Code

Communication
Client/Server or Master/Slave:
• Modbus uses a client/server type protocol. Sometimes referred to as
master/slave. A "master" = "client", while a "slave" = a "server".
• The master/slave terms originated in industry, while the
client/server terms originated in the computer industry. Typically,
the client is the PLC or controller, while the server is a field device
such as a valve bank or sensor block.
• A "client" sends a request to a "server". The server decodes the
request and sends back a response with the requested data or an
acknowledgement.
• Eg. when you use a web browser to view a web page on the
internet, your web browser sends a “page request” to the web server.
The web server decodes the request and sends back a web page as a
“response”. Your e-mail client program fetches your e-mail in the
same way from a mail server.
P.44

• Unit ID:
• A Modbus message includes the unit ID. A unit ID - from 0 and 255
– used to identify the server (slave) address in RS-232 or RS-485 networks.
– Each server (slave) is assigned a "slave ID" number and listens for
messages which contain this number in the unit ID field.
• Modbus/TCP also has the unit ID in its messages, but the Ethernet TCP/IP
address is used to decide where to actually delivery the message. Many or
most server devices will ignore the unit ID. However, some will use the unit ID
to decide whether to forward the message out a built-in serial port. This
message forwarding allows older RS-485 devices to be used on newer
Ethernet networks. Support for this feature is only found in a few devices.
• Message ID:
• When a Modbus message sends a request, it includes a message ID number.
– from 0 to 65,535. It is incremented by the client for each request (and
will roll over to 0 again when it overflows).
– This message ID is echoed back by the server. The client can use this
message ID number to determine if any messages are being lost or
delayed in transmission.
P.45
Unit ID & Message ID

Hardware Classification
• Station Device: 0 ~ 255
• Digital input module
– 1xxxx: 4 digits for hexadecimal address (0000 ~ FFFF)
– 1xxxxx: 5 digital for decimal address (0 ~ 65535)
• Digital output module
• Analog input module
• Analog output module
• Begining of Address
– From 0: VLC
– From 1: InduSoft, iFix
P.46

Two Serial Transmission Modes
• ASCII Mode
– Data system
ASCII character, ‘0’~’9’,’A’~’F’
– Bits per data unit
– Error Check Field
Longitudinal Redundancy Check (LRC)
• RTU Mode
– Data system
8-bit Binary, 00~FF
– Bits per data unit
– Error Check Field
Cyclical Redundancy Check (CRC)
P.47
1 Start Bit 7 Data Bits 1 Parity Bit (Even/Odd) 1 Stop Bit
1 Start Bit 7 Data Bits 2 Stop Bit
1 Start Bit
1 Start Bit
8 Data Bits
8 Data Bits
1 Parity Bit (Even/Odd) 1 Stop Bit
2 Stop Bit

Modbus Message Packet
• ASCII Mode
• RTU Mode
• Modbus Plus network
Byte 0, 1: transaction ID – usually 0
Byte 2, 3: protocol ID = 0
Byte 4, 5: number of bytes following
P.48
Station Number Function Code Data Error Check End
2 Chars 2 Chars n Chars 2 Chars 2 Chars
Start
1 Char
: LRC CR,LF
Station Number Function Code Data Error Check End
1 Char 1 Char n Chars 2 Chars 3.5 Chars
Start
3.5 Char
Silence CRC Silence
Station Number Function Code Data
Prefixed Data
6 x 8 Bits

Modbus Function Code
• 01: read DOs (0xxxx)
• 02: read DIs (1xxxx)
• 03: read AOs (4xxxx)
• 04: read AIs (3xxxx)
• 05: write single DO (0xxxx)
• 06: write single AO (4xxxx)
• 15: wirte DOs (0xxxx)
• 16: write AOs (4xxxx)
P.49

System Application
P.50
Internet
RS-232
RS-485
Multi Modbus/TCP Clients (Masters)
VxComm Technique
Modbus/TCP Slave
Multi Serial Clients (Masters)
Modbus/TCP command protocol
command protocol depend on serial
devices

System Application
P.51
Multi Modbus/TCP Clients (Masters)
Modbus/RTU
Modbus/TCP
Internet
Modbus/RTU

8000E –MTCP Features
• Supports Modbus/TCP communication protocol to access I/Os that plug on slots
• Supports VxComm technique for every COM port of controllers
• Auto scan I/O modules
• Automatically range register address of I/O modules
• Allows multi-client (or master) access simultaneously
• Online configuration (using Modbus Utility via Ethernet)
• Supports I-8000 and I-87000 series I/O modules
• Firmware updateable and programmable
P.52

Tools
• MiniOS7 Utility (Download files and update OS
image)
• PCDiag (Diagnostic tools)
• NAP OPC Server (Check I/O action quickly)
• MBTCP.exe (Check Modbus/TCP package details)
• MBRTU.exe (Check Modbus/RTU package
details)
P.53

8000E-MTCP Program Block
P.54
HMI
SCADA
Modbus Embedded Controller
Run User Process
Update I/O
Check Modbus Request
I-7000
. . .
RS-485
I-7000
RS-232
I-87K
PLC
Modbus protocol User-defined protocol

8000E -MTCP SDK Features
• 2 communication protocols
– User-defined: port 10000
– Modbus/TCP: port 502
• 4 Internal register tables (MTDemo50)
iMemory_DI
iMemory_DO
iMemory_AI
iMemory_AO
• Access I/Os that plug on slots (MTDemo51)
• Link I-7000 or I-87000 series modules via COM ports
(MTDemo52)
• Modbus/RTU master (MTDemo53)
P.55
Points of DI module plug on slots User-defined
Points of DO module plug on slots
Points of AI module plug on slots
Points of AO module plug on slots
User-defined
User-defined
User-defined

User-defined Internal Registers
Modbus/TCP
P.57
iMemory_DI
iMemory_AI
iMemory_DO
iMemory_AO
Modbus Kernel
Read
Write
User Process
I-7000
. . .
RS-485
I-7000 I-87K
RS-232
Slot

Be a Modbus/RTU Master
P.58
iMemory_DI
iMemory_AI
iMemory_DO
iMemory_AO
User Process
Modbus/RTU
Modbus/RTU
Input
Output
User-defined Input
User-defined Output
int ModbusMaster2Slave(int iPort,unsigned char cNetID, unsigned char cFunction,
int iControllerMemoryBaseAddress, int iDeviceMemoryBaseAddress,int iIOCount);

Modify 8000E-MTCP Firmware
• User.c
void UserInit(void)
{
int iRet;
iRet=InitModbus();
}
void UserLoopFun(void)
{
UpdateIOModule();
CheckModbusRequest(iModbusUpLinkPort); //Is any Modbus/RTU request from COM port ?
CheckLEDMenu();
}
int UserCmd(unsigned char *Cmd,unsigned char *Response)
{
int iRet;
if(Cmd[0]=='!')
iRet=Configuration(Cmd,Response);
return 1;
}
P.59

Modify 8000E-MTCP Firmware
• MBTCP_8E.h
//Memory base address of every slot
extern unsigned int iMemoryAddr_DI[8];
extern unsigned int iMemoryAddr_DO[8];
extern unsigned int iMemoryAddr_AI[8];
extern unsigned int iMemoryAddr_AO[8];
//I/O points of every slot
extern unsigned int iMemoryNum_DI[8];
extern unsigned int iMemoryNum_DO[8];
extern unsigned int iMemoryNum_AI[8];
extern unsigned int iMemoryNum_AO[8];
//The I/O values
extern unsigned char* iMemory_DI;
extern unsigned char* iMemory_DO;
extern int* iMemory_AI;
extern int* iMemory_AO;
//Total DI,DO,AI,AO points
extern int iDINum,iDONum,iAINum,iAONum;
P.60

7188E-MTCP System Application
P.61
Internet
RS-232
RS-485
Multi Modbus/TCP Masters (Clients)
VxComm Technique
Multi Serial Master (Clients)
Modbus/TCP
command protocol
command protocol
depend on serial
devices
Modbus/RTU
Single Modbus/RTU Masters (Clients)
Modbus/RTU command
protocol
RS-232/485

7188E-MTCP COM Port Enable Mode
• VxComm (Virtaul COM)
• Modbus/RTU  Links to Modbus/RTU slave
devices
• Programming  Links to RS-232/485/422
devices (controlled by user’s program)
• UpLink  Links to a Modbus/RTU master
device
• Debug  Prints out communication messages
P.62

7188E-MTCP Internal Block
P.63
I-7000
…
I-7000
RS-232
Expansion Bus
I-87K
X board
HMI
SCADA
Modbus Embedded Controller
Run User Process
Read/Write I/O
Check Modbus Request
RS-485
User-defined protocol
Modbus protocol
Modbus/RTU

7188E-MTCP Features
• Converts single Modbus/TCP to multi
Modbus/RTU (Modbus/TCP slave port)
• Converts single Modbus/RTU to multi
Modbus/RTU (Modbus/RTU slave port)
• Supports VxComm technique for every COM
port of controllers
• Allowed multi-client (or master) access
simultaneously
• Firmware updateable and programmable
P.64

7188E-MTCP SDK Features
• Modbus/TCP to Modbus/RTU converter (Default function)
• 4 Internal register tables (MTDemo00)
iMemory_DI
iMemory_DO
iMemory_AI
iMemory_AO
• Link I-7000 or I-87000 series modules via COM
ports (MTDemo01)
• Access X-board (MTDemo02)
• Modbus/RTU master (MTDemo03)
P.65
User-defined
User-defined
User-defined
User-defined

User-defined Internal Register (7188XB,7188E)
Modbus/TCP
P.66
iMemory_DI
iMemory_AI
iMemory_DO
iMemory_AO
Modbus Kernel
Read
Write
User Process
I-7000
. . .
RS-485
I-7000 I-87K
RS-232
Expansion Bus
X board

Modbus/RTU master (7188XB,7188E)
P.67
iMemory_DI
iMemory_AI
iMemory_DO
iMemory_AO
User Process
Modbus/RTU
Modbus/RTU
Input
Output
User-defined Input
User-defined Output
int ModbusMaster2Slave(int iPort,unsigned char cNetID, unsigned char cFunction,
int iControllerMemoryBaseAddress, int iDeviceMemoryBaseAddress,int iIOCount);

Modbus Gateway Application 1
• Original system: one PC connect to a
HoneyWell PLC
• Requirement: allow two extra PCs to
connect to the same PLC
• Problem: the communication interface of
the PLC is RS-232.
RS-232 is point to point interface, it
cannot links 4 devices (3 PCs + 1 PLC)
P.68
iFix (A)
HoneyWell
Modbus/RTU device
RS-232 @ 38400 bps
iFix (B)
iFix (C)

Thinking 1 (RS-485 method)
• Thinking: RS-485 is a broadcast interface.
Change to RS-485 interface can allow all PCs
communicate with the PLC.
• Problem: The PLC will broadcast its response
to every PC.
The two PCs will feel confuse.
• Final: Doesn’t work
P.69
Request
1
2
2
2
Response
iFix (A)
iFix (B)
iFix (C)

Thinking 2 (Ethernet to RS-232 converter)
• Thinking: the converter allow the 3 PCs share
one COM port
• Problem: The communication band width is
shared by the 3 PCs.
Thus the communication efficiency
becomes 1/3.
• Final: Works but not efficient.
P.70
Hub COM1 @ 38400 bps
Modbus/RTU
Request
Modbus/RTU
Response
10
Modbus/RTU
Request
3
Modbus/RTU
Response
HoneyWell
Modbus/RTU device
1
4
5
9
12
8
6
2
7
11
Ethernet/RS-232
converter
iFix (A)
iFix (A)
iFix (A)

Thinking 3 (Modbus/TCP Gateway)
P.71
Hub COM1 @ 38400 bps
Modbus/TCP
Request
Modbus/RTU
Response
10
Modbus/RTU
Request
3
Modbus/TCP
Response
HoneyWell
Modbus/RTU device
1
4
5
9
12
8
6
2
7
11
iFix (A)
iFix (B)
iFix (C)
7188E-MTCP
Thinking: Doesn’t need to install extra VxComm driver on the PC
Problem: The communication band width is shared by the 3 PCs.
Thus the communication efficiency becomes 1/3.
Final: Works but inefficient.

Thinking 3 (Modbus/TCP Gateway)
• Thinking: 7188E polls PLC’s memory to its share
memory
The 3 PCs get PLC’s data from the share
memory
• Goods: Ethernet communication is much faster
than RS-232,
The 3 PCs can get PLC data in very short
time (less than 1 second)
• Final: Works and efficient
P.72
Hub
COM1 @ 38400 bps
Modbus/TCP
Request
Modbus/RTU
Response
Modbus/RTU
Request
B
Modbus/TCP
Response
HoneyWell
Modbus/RTU device
1
2
3
5
6
4 A
iFix (A)
iFix (B)
iFix (C)
7188E-MTCP
Share
Memory

Modbus Gateway Application 2
• Original system: one ABB DCS connect to one
AB PLC
• Requirement: The system needs to include
two AB PLC more.
• Problem: The communication interface of the
DCS and PLC is RS-232
P.73
RS-232 @ 9600 bps
AB PLC #1
AB PLC #2
AB PLC #3

Solution
• Hardware: 7188XB + X505 = 4* RS-232 port +
1* RS-485
• Software: 7188XB polls 3 AB PLC’s data to its
share memory
ABB DCS access the 7188XB to get all
data of the 3 AB PLCs
P.74
RS-232 @ 9600 bps
AB PLC #1
AB PLC #2
AB PLC #3
ABB DCS
Analog Output
Analog Input
Analog Input
Share
Memory
7188XB
DI DO AI AO

Multi PC access PLCs on the same RS-485
P.75
Hub
RS-485
Modbus/TCP
Request
Modbus/RTU
Response
Modbus/RTU
Request
B
Modbus/TCP
Response
1
2
3
5
6
4 A
Share
Memory
PLC#1 PLC#2 PLC#3
7188E-MTCP
Polling PLCs backgroundly

Basics of Communication Modbus training

More Related Content

Similar to Basics of Communication Modbus training (20)

Recently uploaded (20)

Basics of Communication Modbus training