Field Contents In Modbus Messages

Published Date: 02 Nov 2017

In ASCII mode, message start with a ‘colon’ (: ) character (ASCII 0x3A), and end with a ‘carriage return – line feed’ (CRLF) pair (ASCII 0x0D and 0x0A). The allowable characters transmitted for all other fields are hexadecimal 0-9, A-F.

When messages are to be sent over Ethernet, this message frame is handled as a data frame in TCP/IP protocol. Dividing a message frame is not allowed.

START

ADDRESS

FUNCTION

DATA

LRC CHECK

END

1 CHAR

2 CHARS

2 CHARS

n CHARS

2 CHARS

2 CHARS

:

CRLF

Table 2.3.2.1 ASCII Message Frame

2.3.2.2 RTU Framing

In RTU mode, messages start with a silent interval of at least 3.5 character times, and end with a similar interval of at least 3.5 character times. This is most easily implemented as a multiple of character times at the baud rate that is being used on the network (shown as T1-T2-T3-T4 in the figure below). All other fields are composed of 8-bit data.

START

ADDRESS

FUNCTION

DATA

CRC CHECK

END

T1-T2-T3-T4*

8 BITS

8 BITS

n x 8 BITS

16 BITS

T1-T2-T3-T4*

*For T1-T2-T3-T4, 3.5 character times at no communication.

Table 2.3.2.2 RTU Message Frame

2.3.2.3 Address Field

Valid slave device addresses are in the range of 0-247 decimal. The individual slave devices are assigned addresses in the range of 1-247. A master addresses a slave by placing the slave address in the address field of message. When the slave sends its response, it places its own address in this address field of the response to let the master know which slave is responding. Address 0 is used for the broadcast query.

Function Field

Valid function field codes are in the range of 1-255 decimal. When a message is sent from master to a slave device the function code field tells the slave what kind of action to perform. When the slave responds to the master, it uses the function code field to indicate either a normal (error free) response or that some kind of error occurred (called an exception response). For a normal response, the slave simply echoes the original function code. For an exception response, the slave returns a code that is equivalent to the original function code with its most-significant bit set to logic 1. This tells the master what kind of error occurred, or the reason for the exception. Whether a particular function code is applicable or not depends upon the slave device. Check specifications for each slave device.

Data Field

The data field of messages sent from a master to slave devices contains information which the slave must use to take the action defined by the function code. The data field may be of various lengths, or can be nonexistent (of zero length). Refer to specifications for each slave device for the constructions and meaning of the data field.

Error Checking Field

ASCII

When ASCII mode is used for character framing the error checking field contains two ASCII characters. The error check characters are the result of a Longitudinal Redundancy Check (LRC) calculation that is performed on the message content, exclusive of the beginning ‘colon’ and terminating CRLF characters.

RTU

When RTU mode is used for character framing, the error checking field contains a 16-bit value implemented as two 8-bit bytes. The error check value is the result of a Cyclical Redundancy Check calculation performed on the message contents.

LRC Checking

In ASCII mode, messages include an error-checking field that is based on a Longitudinal Redundancy Check (LRC) method. The LRC field checks the contents of the message, exclusive of the beginning ‘colon’ and ending CRLF pair. It is applied regardless of any parity check method used for the individual characters of the message.

The LRC field is one byte, containing an 8-bit binary value. The LRC value is calculated by the transmitting device, which appends the LRC to the message. The receiving device calculates an LRC during receipt of the message, and compares the calculated value to the actual value it received in the LRC field. If the two values are not equal, an error results.

The LRC is calculated by adding together successive 8-bit bytes of the message, discarding any carries, and the two’s complementing the result. It is performed on the ASCII message field contents excluding the ‘colon’ character that begin the message, and excluding the CRLF pair at the end of the message.

E.g.1

The query that reads the resistor value in the Slave device 1 is following.

":", "0", "1", "0", "4", "0", "0", "0", "0", "0", "0", "0", "1", "F", "A", CR/LF

For the above query message, LRC is "F", "A".

CRC Checking

In RTU mode, messages include an error-checking field that is based on a Cyclical Redundancy Check (CRC) method. The CRC field checks the contents of the entire message. It is applied regardless of any parity check method used for the individual characters of the message.

The CRC field is two bytes, containing a 16-bit binary value. The CRC value is calculated by the transmitting device, which appends the CRC to the message. The receiving device recalculates a CRC during receipt of the message, and compares the calculated value to the actual value it received in the CRC field. If the two values are not equal, an error results.

The CRC is started by first preloading a 16-bit register to all 1’s. then a process begins of applying successive 8-bit bytes of the message to the current contents oft the register. Only the eight bits of data in each character are used to generating the CRC. Start and stop bits, and the parity bit if one is used, do not apply to the CRC.

During generation of the CRC, each 8-bit character is exclusive ORed with the register contents. Then the result is shifted in the direction of the least significant bit (LSB), with a zero filled into the most significant bit (MSB) position. The LSB is extracted and examined. If the LSB was 1, the register is then exclusive ORed with a preset, fixed value. If the LSB was a 0, no exclusive OR takes place.

This process is repeated until eight shifts have been performed. After the last (eight) shift, the next 8-bit byte is exclusive ORed with the register’s current value, and the process repeats for eight more shifts as described above. The final contents of the register, after all the bytes of the message have been applied, is the CRC value.

E.g.2

The query that reads the resistor value in the Slave device 1 is following.

0x01, 0x04, 0x00, 0x00, 0x00, 0x01, 0x31, 0xCA

For the above query message, the calculated value of CRC is 0xCA31. The lower-order byte in CRC is appended first, consequently the message order is 0x31, 0xCA.

MODBUS Function Formats

Data Address

Data address are used in MODBUS query messages when reading or modifying data. Four types of data are used: Coil, Input Status, Input Register and Holding Register.

Coil

Coils are used to force the ON/OFF state of discrete outputs (DO) to the field, or to modify the mode or status of slave devices. Coil data is either ON or OFF, which can be both read and modified.

Input Status

Input Status is used for the ON/OFF state of discrete inputs (DI) from the field, or the status of slave devices. The input status is either ON or OFF, which can be read only.

Input Register

Input Registers are used for the value of analog inputs (AI) from the field, or to set information of slave devices. The holding register is of 16-bit long, which can be both read and modified. Floating or double-floating data can be handled when consecutive addresses are assigned.

Holding Register

Holding registers are used for the value of analog output (AO) to the field, or to set information of slave devices. The holding register is of 16-bit long, which can be both read and modified. Floating or double-floating data can be handled when consecutive addresses are assigned

Field contents in MODBUS Messages

All data addresses in MODBUS messages are referenced to 0. The first occurrence of a data item is addressed as item number zero. For example, the input register 30156 decimal is addressed as register 155 decimal in the message field. The function code field specifies data type.

Table 2.3.4a shows an example of a MODBUS query message. The master query is a Read Holding Registers request (function code 03) to slave device address 06. The message requests data from three holding register. Note that the messages specifies the starting register address as 0x6B hex.