MODBUS _ RTU communication protocol detailed explanation
MODBUS _ RTU protocol is an open communication protocol based on serial link (RS232 or RS485), which uses the serial port of the chip to send and receive data messages.
I. Transmission Mode
A transmission mode is a series of independent data structures within an information frame and a finite rule for transmitting the data. The MODBUS _ RTU protocol communicates on the Modbus in RTU mode. Each 8-bit byte in the message is divided into two 4-bit hexadecimal characters. Each message must be transmitted consecutively.
Code system
- 8-bit binary, hexadecimal 0～9, A～F
- Each 8-bit field in the message consists of two hexadecimal characters
Bits per Byte
- 1start bit
- 8 data bits, the least significant bit is sent first
- 1 parity bit, none if no parity
- 1stop bit, 2 bits (without check)
Error detection domain
- CRC (Cyclic Redundancy Check)
II. Agreement
When a frame arrives at the end device, it enters the addressed device through a simple "port". The device removes the "envelope" (header) of the data frame, reads the data, and if there are no errors, performs the task requested by the data. It then adds the data it generates to the acquired "envelope" and returns the data frame to the sender. The returned response data contains the following contents: the address of the terminal slave (Address), the executed command (Function), the requested data (Data) generated by the executed command, and a check code (Check). There will be no successful response for any error.
1) Information frame
The maximum allowable length of Modbus information frame is 256 bytes, that is, the range of N is greater than or equal to zero and less than or equal to 252.
2) Address field
The message frame address field (message address) is at the beginning of the frame and consists of 8 bits. Valid slave device addresses range from 0 to 247 (decimal). The addressing range for each slave device is 1 to 247. The master puts the slave address into the address area of the information frame and addresses the slave. When the slave responds, it puts its own address into the address area of the response message, so that the master can identify the address of the slave that has responded.
Address 0 is a broadcast address and is recognized by all slaves. When the Modbus protocol is used in an advanced network, broadcast or other alternatives are not allowed.
3) Function domain
The function field code of that information frame tell the addressed terminal what function to perform. Valid codes range from 1 to 225 decimal. Some codes apply to all controllers, some apply to certain controllers, and some are reserved for future use.
When the master sends information to the slave, the function code indicates to the slave the action to be executed, such as reading the ON/OFF status of a group of discrete coils or input signals, reading the data of a group of registers, reading the diagnostic status of the slave, writing the coils (or registers), allowing downloading, recording, and confirming the program in the slave, etc.
When the slave responds to the master, the function code may indicate that the slave responded normally or that an error occurred (i.e., not responding normally). In case of normal response, the slave simply returns the original function code; in case of abnormal response, the slave returns a code equivalent to the original code and sets the most significant bit to "1".
For example, when the master requests the slave to read a group of holding registers, the function code of the transmitted information is 0000 0011 (hexadecimal 03). If the slave device receives the requested action information correctly, it returns the same code value as a normal response; if it receives it incorrectly, it returns an abnormal response information: 1000 0011 (hexadecimal 83). The slave modifies the function code and puts a special code in the data area of the response message to tell the master the type of error and the reason for the abnormal response. The application program of the master device is responsible for handling the abnormal response. The typical process is that the master sends the test and diagnosis of the information to the slave and notifies the operator.
The following table lists the commonly used function codes of all devices, their meanings and their initial functions.
|
Code |
Name |
Action |
|
01 |
Read the coil status |
Get the current state of a set of logic coils (ON/OFF) |
|
02 |
Read the input status |
Get the current state of a set of switch inputs (ON/OFF) |
|
03 |
Read the holding register |
Retrieve the current binary value from one or more holding registers |
|
04 |
Read the input register |
Retrieve the current binary value from one or more input registers |
|
05 |
Force the single coil |
Force the on-off state of a logic coil |
|
06 |
Preset single register |
Place a specific binary value into a single register |
|
07 |
Read exception status |
Get the on-off status of 8 internal coils |
|
15 |
Forced multi-coil |
Forcing on and off of a series of continuous logic coil |
|
16 |
Preset multiple register |
Place a specific series of binary values into a series of multiple register |
|
17 |
Report slave ID |
The master can judge the type of the addressed slave and the state of the operation indicator light of the slave |
4) Data domain
The data field contains the data required by the terminal to perform a specific function or the data collected by the terminal in response to a query. The content of these data may be a numerical value, a reference address, or a limit value.
For example, the function field code tells the terminal to read a register, while the data field indicates which register to start from and how many data to read. The embedded address and data vary according to the type and response capability of the slave. If no error occurs, the response message from the slave to the master contains the request data; If there is an error, there is an abnormal code in the data, so that the host can judge and make the next action. The length of the data area may be "zero" to indicate a certain type of information.
5) Error check field
This domain allows hosts and terminals to check for errors during transmission. Sometimes, due to electrical noise and other interference, a set of data may change on the wire as it travels from one device to another. Error checking can ensure that the host or terminal does not respond to data that has changed during transmission, which improves the security and efficiency of the system. The error check uses a 16-bit cyclic redundancy method, or CRC check.
The error detection field is 16 bits (implemented with two 8-bit characters). The content of the error detection field is derived by applying a cyclic verbosity detection method to the content of the message. The CRC field is appended at the end of the message with the low byte followed by the high byte, so the high byte of the CRC is the last byte of the transmitted message.
6) Continuous transmission of characters
When messages are transmitted over a standard Modbus series network, each character or byte is sent in left-to-right order: least significant bit (LSB) … Most significant bit (MSB).
The sequence of bits is:
There is parity
No parity
III.Error detection
1) Parity
The user can configure whether the controller is odd parity, even parity, or no parity. This will determine how the parity bits are set in each character.
If odd parity or even parity is specified, the number of bits of "1" is counted in the number of bits of each character (7 data bits in ASCII mode and 8 data bits in RTU mode). For example, the RTU character frame contains the following 8 data bits: 1 1 0 1 0 1, and the total number of "1" is 4. If even parity is used, the parity bit of the frame will be 0, so that the total number of "1" s is still 4. If odd parity is used, the parity bit of the frame will be 1, so that the total number of "1" s is 5. If no parity bit is specified, the transmission occurs without a parity bit and without parity detection.
2) CRC detection
The CRC method is used to calculate the error check code, and the CRC checks all the data transmitted. It ignores the parity check method for individual character data in the message.
The Cyclic Redundancy Check (CRC) field occupies two bytes and contains a 16-bit binary value. The CRC value is calculated by the transmitting device and then appended to the data frame. The receiving device recalculates the CRC value when it receives the data and then compares it with the value in the received CRC field. If the two values are not equal, an error has occurred.
CRC starts by setting all 16 bits of the register to "1", and then putting the data of two adjacent 8-bit bytes into the current register. Only the 8-bit data of each character is used to generate the CRC, and the start bit, stop bit, and parity bit are not added to the CRC.
In generating the CRC, each 8-bit byte is XORed with the contents of the register and the result is shifted toward the lower bits, with the upper bits being supplemented with "0" s. The least significant bit (LSB) is shifted out and detected. If it is 1, the register is XORed with a preset fixed value. If the least significant bit is 0, nothing is done.
The above process is repeated until the 8 shift operations are performed. After the last bit (the 8th bit) is shifted, the next 8-bit byte is XORed with the current value of the register. The other 8 shift XORs are also performed. When all the bytes in the data frame are processed, the final value generated is the CRC value.
The process of generating a CRC is as follows:
① Preset a 16-bit register to 0FFFFH (all 1s), called the CRC register.
② Xor the first 8-bit byte in the data frame with the low byte in the CRC register, and store the result back to the CRC register.
③ Shift the CRC register to the right by one bit, fill the highest bit with 0, and shift out the lowest bit for detection.
④ If the lowest bit is 0: repeat step 3 (next shift). If the least significant bit is 1: Xor the CRC register with a preset fixed value (0 A001H).
⑤ Repeat steps 3 and 4 until 8 shifts. In this way, a complete eight bits are processed.
⑥ Repeat steps 2 through 5 to process the next octet until all bytes are processed.
⑦ The final CRC register value is the CRC value.
CRC values are appended to information with the low order bits first and the high order bits last.