Using MODBUS for Process Control and Automation

1 Page 1 The Interface Solution Experts MODBUS forProcess Control and AutomationMODBUS is the most popular industrial protocol beingused today, for good reasons. It is simple, inexpensive,universal and easy to use. Even though MODBUS hasbeen around since the past century nearly 30 years almost all major industrial instrumentation and automationequipment vendors continue to support it in new new analyzers, flowmeters and PLCs may havea wireless, Ethernet or fieldbus interface, MODBUS isstill the protocol that most vendors choose to implementin new and old advantage of MODBUS is that it can run overvirtually all communication media, including twisted pairwires, wireless, fiber optics, Ethernet, telephonemodems, cell phones and microwave.

2 This means that aMODBUS connection can be established in a new orexisting plant fairly easily. In fact, one growing applicationfor MODBUS is providing digital communications in olderplants, Using existing twisted pair this white paper, we ll examine how MODBUS worksand look at a few clever ways that MODBUS can be usedin new and legacy is MODBUS ? MODBUS was developed by Modicon (now SchneiderElectric) in 1979 as a means for communicating withmany devices over a single twisted pair wire. The originalscheme ran over RS232, but was adapted to run onRS485 to gain faster speed, longer distances and a truemulti-drop network.

3 MODBUS quickly became a de factostandard in the Automation industry, and Modiconreleased it to the public as a royalty free , MODBUS -IDA ( ), the largestorganized group of MODBUS users and vendors, contin-ues to support the MODBUS protocol is a master-slave system, where the master communicates with one or multiple slaves. The mastertypically is a PLC (Programmable Logic Controller), PC,DCS (Distributed Control System) or RTU (RemoteTerminal Unit). MODBUS RTU slaves are often fielddevices, all of which connect to the network in a multi-drop configuration, Figure 1.

4 When a MODBUS RTUmaster wants information from a device, the mastersends a message that contains the device s address,data it wants, and a checksum for error detection. Everyother device on the network sees the message, but onlythe device that is addressed devices on MODBUS networks cannot initiatecommunication; they can only respond. In other words,they speak only when spoken to. Some manufacturersare developing hybrid devices that act as MODBUS slaves, but also have write capability, thus making thempseudo-Masters at three most common MODBUS versions used todayare: MODBUS ASCII MODBUS RTU MODBUS /TCPAll MODBUS messages are sent in the same format.

5 Theonly difference among the three MODBUS types is in howthe messages are MODBUS ASCII, all messages are coded in hexadeci-mal, Using 4-bit ASCII characters. For every byte ofinformation, two communication bytes are needed, twiceas many as with MODBUS RTU or , MODBUS ASCII is the slowest of the threeprotocols, but is suitable when telephone modem or radio(RF) links are used. This is because ASCII uses charac-ters to delimit a message. Because of this delimiting ofthe message, any delays in the transmission medium willnot cause the message to be misinterpreted by thereceiving device.

6 This can be important when dealing withslow modems, cell phones, noisy connections, or otherdifficult transmission 1. A MODBUS RTU network consists of one master, suchas a PLC or DCS, and up to 247 slave devices connected in amulti-drop SignalsProcessMeasurementsProcessMeasure mentsMODBUS RTU MasterMODBUS RS485 Twisted Wire PairNET Concentrator SystemStation #2 NET Concentrator SystemStation #14-20mA SignalsMODBUS RS485 Twisted Wire PairPage 2 The Interface Solution Experts MODBUS forProcess Control and AutomationTableAddresses1-999910001-1999 930001-3999940001-49999 Read or WriteRead OnlyRead OnlyRead or WriteTypeTableNameCoilsDiscrete InputsInput RegistersHolding RegistersFigure 3.

7 The literature or operation manuals of most MODBUS -compatible devices, such as this TMZ Temperature Transmitterfrom Moore Industries, publish the addresses of key variables inthe MODBUS Memory Map. The TMZ s addresses conform to theMODBUS 2. Function MODBUS RTU, data is coded in binary, and requiresonly one communication byte per data byte. This is idealfor use over RS232 or multi-drop RS485 networks, atspeeds from 1,200 to 115 Kbaud. The most commonspeeds are 9,600 and 19,200 baud. MODBUS RTU is themost widely used industrial protocol, so most of thispaper will focus on MODBUS RTU basics and is simply MODBUS over Ethernet.

8 Insteadof Using device addresses to communicate with slavedevices, IP addresses are used. With MODBUS /TCP, theMODBUS data is simply encapsulated inside a TCP/IPpacket. Hence, any Ethernet network that supports TCP/IP should immediately support MODBUS /TCP. Moredetails regarding this version of MODBUS will be coveredin a later section entitled MODBUS Over Ethernet. MODBUS RTU BasicsTo communicate with a slave device, the master sends amessage containing: Device Address Function Code Data Error CheckThe Device Address is a number from 0 to 247. Messagessent to address 0 (broadcast messages) can be acceptedby all slaves, but numbers 1-247 are addresses of specificdevices.

9 With the exception of broadcast messages, aslave device always responds to a MODBUS message sothe master knows the message was the deviceThe Function Code defines the command that the slavedevice is to execute, such as read data, accept data,report status, etc. (Figure 2). Function codes are 1 to255. Some function codes have sub-function Data defines addresses in the device s memory mapfor read functions, contains data values to be written intothe device s memory, or contains other informationneeded to carry out the function Error Check is a 16-bit numeric value representingthe Cyclic Redundancy Check (CRC).

10 The CRC is gener-ated by the master (via a complex procedure involvingORing and shifting data) and checked by the receivingdevice. If the CRC values do not match, the device asksfor a retransmission of the message. In some systems, aparity check can also be the slave device performs the requested function, itsends a message back to the master. The returningmessage contains the slave s address and requestedfunction code (so the master knows who is responding),the data requested, and an Error Check Memory MapEach MODBUS device has memory, where processvariable data is stored.