Detailed explanation and example demonstration of Modbus RTU communication protocol

Modbus Detailed explanation of communication protocol

Modbus RTU Communication protocol In data communication, the mode of master-slave response is adopted . Only by main engine （PC,HMI etc. ） Send a request through a unique slave address , Slave （ Terminal equipment ） Respond to host requests , That is, half duplex communication . This protocol only allows the host to initiate requests , The slave responds passively , Therefore, the slave will not actively occupy the communication line, causing data conflict .

similar Modbus RTU agreement The master-slave response protocol of and Siemens PPI、 Commonly used by electricity meters DL/T645-2007 Such agreement .

One 、modbus agreement Format

Information is transmitted asynchronously , Use 16 Base to communicate , Information frame format ：

Address code	Function code	Data area	CRC Check code
1 byte	1 byte	N byte	2 byte

Address code

The address code is the first byte of each communication information frame , General support 1 To 247, Some devices also support 0 Address , It is used to receive the broadcast data of the host , Each slave must have a unique address on the bus , Only the slave that matches the address code sent by the host can respond to the return data .

Function code

Function code is the second byte of each communication information frame . Host send , Tell the slave device what operation it should perform through the function code .

Eight common function codes ：

Function code	Definition	operation
01H	Read coil	Read one or more continuous coil states
05H	Write a single coil	Operate the coil state at the specified position
0FH	Write multiple coils	Operate multiple continuous coil states
02H	Read discrete input	Read one or more continuous discrete input states
04H	Read input register	Read one or more consecutive input register data
03H	Read holding register	Read one or more holding register data
06H	Write a single holding register	Write the two hexadecimal data to the corresponding position
10H	Write multiple holding registers	hold 4*N Hexadecimal data is written N Consecutive holding registers

Data area

The data area varies with the function code and the data direction , The data can be “ Register first address + Number of read registers ”、“ Register address + Operational data ”、“ Register first address + Operation deposit quantity + Data length + data ” And other different combinations , stay “ Function code analysis ” Explain the data areas of different function codes in detail .

Modbus CRC check

Modbus RTU Protocols are often used in industrial sites, which have high requirements for the stability and correctness of data transmission , So by CRC Check to ensure the correctness and integrity of data transmission .

Two 、 Wrong feedback

Address and CRC Verification errors will not receive data feedback from the slave , Other errors will return error codes to the host . Add 0X80 Indicates that an error occurred in the request （ Illegal function code 、 Illegal data value, etc ）, The error data frame is as follows ：

Address code	Function code	Error code	CRC Check code
1 byte	1 byte	1 byte	2 byte

Common error codes are as follows ：

value	name	explain
01H	Illegal function code	This function code operation register is not supported
02H	Illegal register address	Access the register that the device is forbidden to access
03H	Illegal data value	Write unsupported parameter values
04H	Slave failure	The equipment works abnormally

3、 ... and 、 Communication information transmission process

When the communication command is sent by the host to the slave , The slave receives communication commands that match the address code sent by the host , If CRC It's all right , Then perform the corresponding operation , And then put the execution result （ data ） Back to the host . The return information contains the address code 、 Function code 、 Data after execution and CRC Check code . If the address does not match or CRC If there is an error in verification, no information will be returned .

Four 、 Function code analysis

Function code 01H： Read the coil

for example ： The address of the master to read from the slave is 01H, The starting coil address is 00H Of 1 Coil status , Host send ：

Host send		send data （HEX）
Address code		01
Function code		01
Starting coil address	High byte	00
	Low byte	00
Number of coils	High byte	00
	Low byte	01
CRC check	Low byte	FD
	High byte	CA

If the slave register 00H The coil is closed , Return from the plane ：

Return from the plane		send data （HEX）
Address code		01
Function code		01
Number of bytes		01
Coil state		01
CRC Check code	Low byte	90
	High byte	48

Function code 0FH： Write multiple coils

for example ： The master should control the slave address to 01H, The starting coil address is 00H Of 4 Coil status , Host send ：

Host send		send data （HEX）
Address code		01
Function code		0F
Starting coil address	High byte	00
	Low byte	00
Number of coils	High byte	00
	Low byte	04
Number of bytes written		01
The control mode		00( Disconnect all )、0F( All closed )
CRC check	Low byte	XX
	High byte	XX

Function code 0FH operation , Return from the plane ：

Return from the plane		send data （HEX）
Address code		01
Function code		0F
Starting coil address	High byte	00
	Low byte	00
Number of coils	High byte	00
	Low byte	04
CRC check	Low byte	54
	High byte	08

Function code 02H： Read discrete input

for example ： The address of the master to read from the slave is 01H, The starting discrete address is 00H Of 4 Input status , Host send ：

Host send		send data （HEX）
Address code		01
Function code		02
Starting discrete address	High byte	00
	Low byte	00
Number of reads	High byte	00
	Low byte	04
CRC check	Low byte	79
	High byte	C9

If from the front address 00H At the beginning 4 Discrete inputs all detected inputs , Return from the plane ：

Return from the plane		send data （HEX）
Address code		01
Function code		02
Number of bytes		01
Discrete input states		0F
CRC Check code	Low byte	E1
	High byte	8C

Function code 04H： Read input register

for example ： The address of the master to read from the slave is 01H, The starting register address is 02H Of 1 Input register data , Host send ：

Host send		send data （HEX）
Address code		01
Function code		04
Start register address	High byte	00
	Low byte	02
Number of registers	High byte	00
	Low byte	01
CRC check	Low byte	90
	High byte	0A

If the slave input register 02H The data is 3344H, Return from the plane ：

Return from the plane		send data （HEX）
Address code		01
Function code		04
Number of bytes		02
register 05H data	High byte	33
	Low byte	44
CRC Check code	Low byte	AD
	High byte	F3

Function code 03H： Read holding register

for example ： The address of the master to read from the slave is 01H, The starting register address is 05H Of 2 Hold register data , Host send ：

Host send		send data （HEX）
Address code		01
Function code		03
Start register address	High byte	00
	Low byte	05
Number of registers	High byte	00
	Low byte	02
CRC check	Low byte	D4
	High byte	0A

If the slave holds the register 05H、06H The data is 1122H、3344H, Return from the plane ：

Return from the plane		send data （HEX）
Address code		01
Function code		03
Number of bytes		04
register 05H data	High byte	11
	Low byte	22
register 06H data	High byte	33
	Low byte	44
CRC Check code	Low byte	4B
	High byte	C6

 

Function code 06H： Write a single holding register

for example ： Host write 9988H The address of the data to the slave is 01H, The register address is 0050H The register of , Host send ：

Host send		send data （HEX）
Address code		01
Function code		06
Register address	High byte	00
	Low byte	50
Write the value	High byte	99
	Low byte	88
CRC check	Low byte	E3
	High byte	ED

The slave return is the same as the host request ;

Function code 10H： Write multiple holding registers

for example ： The host is going to send the data 0005H、2233H Save to the slave address 01H, The starting register address is 0020H Of 2 In registers , Host send ：

Host send		send data （HEX）
Address code		01
Function code		10
Start register address	High byte	00
	Low byte	20
Number of registers	High byte	00
	Low byte	02
Number of bytes written		04
0000H Register to be written	High byte	00
	Low byte	05
0001H Register to be written	High byte	22
	Low byte	33
CRC check	Low byte	B9
	High byte	03

Function code 10H operation , Return from the plane ：

Return from the plane		send data （HEX）
Address code		01
Function code		10
Start register address	High byte	00
	Low byte	20
Number of registers	High byte	00
	Low byte	02
CRC check	Low byte	40
	High byte	02

Simulation demonstration ：