MODBUS protocol parsing

Modbus is a packet transmission protocol at the application layer. Modbus is not unique and can be used in three formats: RTU, ASCII, and TCP. The application scenarios are different. Most devices are Modbus-RTU or Modbus TCP.

1, The communication mode of Ethernet is MODBUS TCP.

2, asynchronous serial transmission (various media such as wired RS232, RS485, optical fiber, wireless, etc.), the corresponding communication mode is MODBUS RTU or MODBUS ASCII.



For example, the Modbus RTU communication protocol:
1. Storage area (data storage area, file storage area)
There are four kinds:
Output coil: Code is 0
Input coil: Code 1
Output (write) register: code 4
Enter (read) register: The code is 3
Coil: The smallest unit bool, either stored as 1 or 0.
Register: 16 bits, 2 bytes
Summary: If using bool, use coil; If you want to store data, use registers.
________________________________________
2. Storage area range
5 - and 6-bit standard addresses (5 bits) and extended addresses
Standard address (5 digits) :
YXXXX
Y indicates the storage area. The value can be 0, 1, 3, or 4
X The value ranges from 0 to 9
Output coil: code is 0, storage range: 00001-09999
Input coil: code is 1, storage range: 10001-19999
Output (write) register: code is 4, storage range: 40001-49999
Input (read) register: code is 3, storage range: 30001-39999
Extended address (6 bits) :
YXXXXX
Output coil: Storage range: 000001-065536
Input coil: code is 1, storage range: 100001-165536
Output (write) register: code is 4, storage range: 400001-465536
Input (read) register: code is 3, storage range: 300001-365536
________________________________________
3. Communication protocol
Eight actions: four reads, four writes
Read output coil: Function code: 01 (hexadecimal)
Read input coil: Function code: 02
Read output register: function code: 03
Read input register: Function code: 04
Write a single output coil: function code: 05
Write a single output register: function code: 06
Write multiple output coils: Function code: 15
Write multiple output registers: function code: 16
Message format:
Slave address (device ID 1byte) + Function code (1byte) + Data (N bytes) + verification (2 bytes)
For reading:
Slave address (device number) : To distinguish which device it is.
Function code: To determine what to do.
Data: The details of what exactly.
Verification: verify
For write
Slave address (device number) : To distinguish which device it is.
Function code: To determine what to do.
Data: Details of what exactly (more, with a specific value written).
Verification: verify
Here's an example:
Monitor com24 port: Collect humidity and temperature
PC send: 01 03 00 00 00 02 C4 0B
01 Station address
03 Function code: read output register
00 00 Start register
00 02 Register length
C4 0B CRC verification
Device return: 01 03 04 01 46 01 3B 5A 59
01 Station address
03 Function code: read output register
04 Byte count (Total number of bytes)
01 46 01 3B Data contains 4 bytes
5A 59 CRC check
Among them:
01 46 Indicates the humidity. The value is in hexadecimal notation and is 326,326/10 =32.6
01 3B Indicates the temperature. The hexadecimal value is 315, 315/10=31.5
ModbusCRC check code is calculated by the algorithm, do not need to investigate how to calculate, can calculate it
What is the Modbus address for temperature? 40001-> Absolute address
What is the Modbus address for humidity? 40002-> Absolute address
Absolute addresses are not used on the protocol because 03 is already specified as a read output register.
All communication protocols use relative addresses, which start at 0.


Service hotline

+86-13732162613

0.058926s