Using MODBUS for Process Control and Automation

1 Page 1 The Interface Solution Experts MODBUS forProcess Control and AutomationMODBUS is the most popular industrial protocol beingused today, for good reasons. It is simple, inexpensive,universal and easy to use. Even though MODBUS hasbeen around since the past century nearly 30 years almost all major industrial instrumentation and automationequipment vendors continue to support it in new new analyzers, flowmeters and PLCs may havea wireless, Ethernet or fieldbus interface, MODBUS isstill the protocol that most vendors choose to implementin new and old advantage of MODBUS is that it can run overvirtually all communication media, including twisted pairwires, wireless, fiber optics, Ethernet, telephonemodems, cell phones and microwave. This means that aMODBUS connection can be established in a new orexisting plant fairly easily. In fact, one growing applicationfor MODBUS is providing digital communications in olderplants, Using existing twisted pair this white paper, we ll examine how MODBUS worksand look at a few clever ways that MODBUS can be usedin new and legacy is MODBUS ?

2 MODBUS was developed by Modicon (now SchneiderElectric) in 1979 as a means for communicating withmany devices over a single twisted pair wire. The originalscheme ran over RS232, but was adapted to run onRS485 to gain faster speed, longer distances and a truemulti-drop network. MODBUS quickly became a de factostandard in the Automation industry, and Modiconreleased it to the public as a royalty free , MODBUS -IDA ( ), the largestorganized group of MODBUS users and vendors, contin-ues to support the MODBUS protocol is a master-slave system, where the master communicates with one or multiple slaves. The mastertypically is a PLC (Programmable Logic Controller), PC,DCS (Distributed Control System) or RTU (RemoteTerminal Unit). MODBUS RTU slaves are often fielddevices, all of which connect to the network in a multi-drop configuration, Figure 1. When a MODBUS RTUmaster wants information from a device, the mastersends a message that contains the device s address,data it wants, and a checksum for error detection.

3 Everyother device on the network sees the message, but onlythe device that is addressed devices on MODBUS networks cannot initiatecommunication; they can only respond. In other words,they speak only when spoken to. Some manufacturersare developing hybrid devices that act as MODBUS slaves, but also have write capability, thus making thempseudo-Masters at three most common MODBUS versions used todayare: MODBUS ASCII MODBUS RTU MODBUS /TCPAll MODBUS messages are sent in the same format. Theonly difference among the three MODBUS types is in howthe messages are MODBUS ASCII, all messages are coded in hexadeci-mal, Using 4-bit ASCII characters. For every byte ofinformation, two communication bytes are needed, twiceas many as with MODBUS RTU or , MODBUS ASCII is the slowest of the threeprotocols, but is suitable when telephone modem or radio(RF) links are used. This is because ASCII uses charac-ters to delimit a message. Because of this delimiting ofthe message, any delays in the transmission medium willnot cause the message to be misinterpreted by thereceiving device.

4 This can be important when dealing withslow modems, cell phones, noisy connections, or otherdifficult transmission 1. A MODBUS RTU network consists of one master, suchas a PLC or DCS, and up to 247 slave devices connected in amulti-drop SignalsProcessMeasurementsProcessMeasure mentsMODBUS RTU MasterMODBUS RS485 Twisted Wire PairNET Concentrator SystemStation #2 NET Concentrator SystemStation #14-20mA SignalsMODBUS RS485 Twisted Wire PairPage 2 The Interface Solution Experts MODBUS forProcess Control and AutomationTableAddresses1-999910001-1999 930001-3999940001-49999 Read or WriteRead OnlyRead OnlyRead or WriteTypeTableNameCoilsDiscrete InputsInput RegistersHolding RegistersFigure 3. The literature or operation manuals of most MODBUS -compatible devices, such as this TMZ Temperature Transmitterfrom Moore Industries, publish the addresses of key variables inthe MODBUS Memory Map. The TMZ s addresses conform to theMODBUS 2. Function MODBUS RTU, data is coded in binary, and requiresonly one communication byte per data byte.

5 This is idealfor use over RS232 or multi-drop RS485 networks, atspeeds from 1,200 to 115 Kbaud. The most commonspeeds are 9,600 and 19,200 baud. MODBUS RTU is themost widely used industrial protocol, so most of thispaper will focus on MODBUS RTU basics and is simply MODBUS over Ethernet. Insteadof Using device addresses to communicate with slavedevices, IP addresses are used. With MODBUS /TCP, theMODBUS data is simply encapsulated inside a TCP/IPpacket. Hence, any Ethernet network that supports TCP/IP should immediately support MODBUS /TCP. Moredetails regarding this version of MODBUS will be coveredin a later section entitled MODBUS Over Ethernet. MODBUS RTU BasicsTo communicate with a slave device, the master sends amessage containing: Device Address Function Code Data Error CheckThe Device Address is a number from 0 to 247. Messagessent to address 0 (broadcast messages) can be acceptedby all slaves, but numbers 1-247 are addresses of specificdevices. With the exception of broadcast messages, aslave device always responds to a MODBUS message sothe master knows the message was the deviceThe Function Code defines the command that the slavedevice is to execute, such as read data, accept data,report status, etc.

6 (Figure 2). Function codes are 1 to255. Some function codes have sub-function Data defines addresses in the device s memory mapfor read functions, contains data values to be written intothe device s memory, or contains other informationneeded to carry out the function Error Check is a 16-bit numeric value representingthe Cyclic Redundancy Check (CRC). The CRC is gener-ated by the master (via a complex procedure involvingORing and shifting data) and checked by the receivingdevice. If the CRC values do not match, the device asksfor a retransmission of the message. In some systems, aparity check can also be the slave device performs the requested function, itsends a message back to the master. The returningmessage contains the slave s address and requestedfunction code (so the master knows who is responding),the data requested, and an Error Check Memory MapEach MODBUS device has memory, where processvariable data is stored. The MODBUS specificationdictates how data is retrieved and what type of data canbe retrieved.

7 However, it does not place a limitation onhow and where the device vendor maps this data in itsmemory map. Below would be a common example ofhow a vendor might logically map different types ofprocess variable inputs and coils are one-bit values, and each hasa specific address. Analog inputs (also called InputRegisters ) are stored in 16-bit registers. By utilizing twoof these registers MODBUS can support the IEEE 32-bitfloating point format. Holding Registers are also 16-bitinternal registers that can support floating CoilsRead Discrete InputsRead Holding RegistersRead Input RegistersWrite Single CoilWrite Single RegisterRead Exception StatusDiagnosticsUp to 255 function codes, dependingPage 3 The Interface Solution Experts MODBUS forProcess Control and AutomationData in the memory map is defined in the MODBUS specification. Assuming that the device vendor followedthe MODBUS specification (not all do), all data can easilybe accessed by the MODBUS master, which follows thespecification.

8 In many cases, the device vendor publishesthe memory locations (Figure 3), making it easy for theperson programming the master to communicate with theslave and Writing DataMODBUS has up to 255 function codes, but 01 (readcoils), 02 (read discrete inputs), 03 (read holding regis-ters) and 04 (read input registers) are the most commonlyused read functions that are used to collect data fromNET Concentrator SystemDistributed I/O(Analog Input Module)Figure 4. Home Run Wiring vs MODBUS . In most plants, field instruments connect to the Control system with individual home run twisted pairs (below). When the instruments are wired into a distributed I/O system, such as the NCS from Moore Industries (center),more devices can be added, but only a single twisted pair is needed to transmit all the data to the MODBUS master. Multiple NCS systemscan be networked (bottom) over the same MODBUS network, so the entire plant can be converted from home run wiring to slaves.

9 For example, to read three 16-bit wordsof analog data from device 5 s memory map, the mastersends a command that looks something like this:5 04 2 3 CRCW here 5 is the device address, 04 says to read inputregisters, 2 is the starting address (address 30,002), 3means to read three contiguous data values starting ataddress 30,002, and CRC is the error check value for thismessage. The slave device, upon receiving this command,sends back a response that looks something like this:5 04 aa bb cc CRCPage 4 The Interface Solution Experts MODBUS forProcess Control and AutomationWhere 5 is the device s address; 04 is the repeated readcommand; aa, bb and cc are the three 16-bit data values;and CRC is the error check value for this and writing digital inputs and outputs is done ina similar manner Using different read and write that the device follows the MODBUS specification, it is a simple programming task to set upthe master to read and write data, check status, obtaindiagnostic information and perform various Control andmonitoring MODBUS DevicesOne of the easiest ways to bring field devices into aprocess Control system, PLC or industrial computer is tosimply connect digital and analog I/O into a distributedI/O system that has MODBUS communication example, the NCS (NET Concentrator System) fromMoore Industries allows a user to connect analog anddigital signals remotely, which can then be connected toa MODBUS master via twisted pair cable.

10 Multiple NCSsystems can be installed in several locations throughoutthe plant, all linked by MODBUS (Figure 4).This solution works for both new and existing many existing plants, field instruments typicallyconnect to the DCS or PLC via home run wiring, whereeach device is connected with individual twisted pairsthat carry analog signals. With the NCS, one of thosetwisted pairs can be used for the MODBUS signal. Thisis particularly useful if the plant wants to add additionalfield instruments, but does not want to run more wiring(at an installed cost of $100 per foot). A distributed I/Osystem can accommodate all of the existing I/O, or itcan be used just to send data from all the new some cases, the Control system is not able to dealwith a MODBUS signal. It may be that the legacy controlsystem is accustomed to dealing with 4-20mA analogI/O and directly wired digital I/O, and reprogramming theold system to accommodate MODBUS data would bedifficult. Often, users would like to add new remotesignals to their system without having to run wire or buyexpensive MODBUS interface cards that require extensivere-programming.