Analysis and test of ModbusRTU communication protocol

---

Concept

Modbus It is a communication protocol widely used in industrial control industry , It has nothing to do with the physical layer , It supports a variety of electrical interfaces , Include RS232、RS485、TCP/IP.Modbus The protocol is the application layer message transmission protocol , Define a message structure that the controller can recognize and use ,, Include ASCII、RTU、TCP Three message types . among Modbus-RTU The most commonly used , This chapter mainly analyzes ModbusRTU agreement .

One 、 Tool preparation

For more intuitive analysis ModbusRTU Communication protocol message format , The following debugging tools are used in this chapter .

VSPD( Full name Configure Virtual Serial Port Driver)： When there is no physical serial port , Used to create virtual serial port for computer .

ModbusPoll Software ： Mainly used for simulation Modbus Master station or Modbus client , Select one of the serial ports paired with the virtual serial port software , And set the parameters , You can connect to .

ModbusSlave Software ： Mainly used for simulation Modbus Slave station or Modbus The server , Select another serial port paired with the virtual serial port software , And set the parameters , You can connect to .

Two 、 Protocol analysis

1. Message format

Modbus The message format of the protocol on the serial link is as follows ：

2. register

Modbus The agreement provides for 4 A register , As shown in the following table ：

3. Function code

Modbus The protocol adopts function code , Used for reading and writing the above registers , As shown in the following table ：

3、 ... and 、 Protocol testing

1. Read holding register

As shown in the figure above ： The master station sends messages ：01 03 00 00 00 0A C5 CD.
Slave reply message ：01 03 14 00 11 00 16 00 21 00 2C 04 83 12 34 33 FF EE FF 11 23 EE 36 DC 4B.
The meaning of the message sent by the master station ：0x01： Slave address ,0x03： Function code , 00 ： Address start （ high ）,0x00： Address start （ low ）,0x00： Number （ high ）,0A: Number （ low ）,2C 04 ： check . Read 1 No. slave station holding register , The starting address is 0, The number of 0x0A=10, common 10 Hold the value of the register .（ notes ： The addresses represented by the message are relative addresses ）
The meaning of the message replied by the slave station ：01： Slave address ,03： Function code ,0x14: Byte count , 00 11 00 16 00 21 00 2C 04 83 12 34 33 FF EE FF 11 23 EE 36 : Every two bytes correspond to the high and low order of the value of each holding register . DC 4B： check .

2. Read the output coil

As shown in the figure above ： The master station sends messages ：01 01 00 00 00 0A BC 0D.
Slave reply message ：01 01 02 A2 00 C0 9C
The meaning of the message sent by the master station ：0x01： Slave address ,0x01： Function code , Read the status value of the output coil , 00 ： Address start （ high ）,00： Address start （ low ）,00： Number （ high ）,0A: Number （ low ）,2C 04 ： check . Read 1 No. slave station holding register , The starting address is 0, The number of 0x0A=10, common 10 The status value of a holding register .
The meaning of the message replied by the slave station ：0x01： Slave address ,0x01： Function code , Read the status value of the output coil ,0x02: Byte count ,0xA2 = 1010 0010 Address 0-7 The corresponding state values of the coils .0x00 = 0000 0000 Address 8-9 The status value corresponding to the coil .