Communication protocol | |
Developer(s) |
|
---|---|
Introduction | 1979 |
Modbus or MODBUS is a client/server data communications protocol in the application layer. [1] It was originally designed for use with programmable logic controllers (PLCs), [2] but has become a de facto standard communication protocol for communication between industrial electronic devices in a wide range of buses and networks. [3] [1]
Modbus is popular in industrial environments because it is openly published and royalty-free. It was developed for industrial applications, is relatively easy to deploy and maintain compared to other standards, and places few restrictions on the format of the data to be transmitted.
The Modbus protocol uses serial communication lines, Ethernet, or the Internet protocol suite as a transport layer. [1] Modbus supports communication to and from multiple devices connected to the same cable or Ethernet network. For example, there can be a device that measures temperature and another device to measure humidity connected to the same cable, both communicating measurements to the same computer, via Modbus.
Modbus is often used to connect a plant/system supervisory computer with a remote terminal unit (RTU) in supervisory control and data acquisition (SCADA) systems. Many of the data types are named from industrial control of factory devices, such as ladder logic because of its use in driving relays: a single-bit physical output is called a coil, and a single-bit physical input is called a discrete input or a contact.
It was originally published by Modicon in 1979. The company was acquired by Schneider Electric in 1997. In 2004, they transferred the rights to the Modbus Organization [4] which is a trade association of users and suppliers of Modbus-compliant devices that advocates for the continued use of the technology. [5]
Modbus standards or buses include: [1]
To support Modbus communication on a network, many modems and gateways incorporate proprietary designs (refer to the diagram: Architecture of a network for Modbus communication). Implementations may deploy either wireline or wireless communication, such as in the ISM radio band, and even Short Message Service (SMS) or General Packet Radio Service (GPRS).
Modbus defines client which is an entity that initiates a transaction to request any specific task from its request receiver. [6] The client's "request receiver", which the client has initiated the transaction with, is then called server. [6] For example, when a Microcontroller unit (MCU) connects to a sensor to read its data by Modbus on a wired network, e.g RS485 bus, the MCU in this context is the client and the sensor is the server. In former terminology, the client was named master and the server named slave.
Modbus defines a protocol data unit (PDU) independently to its lower layer protocols in its protocol stack. Mapping MODBUS protocol on specific buses or networks requires some additional fields, defined as the application data unit (ADU). The ADU is formed by a client inside a Modbus network when the client initiates a transaction. Contents are: [7]
The ADU is officially called a Modbus frame by the Modbus Organization, [7] although frame is used as the data unit in the data-link layer in the OSI and TCP/IP model (while Modbus is an application layer protocol).
PDU max size is 253 bytes. ADU max size on RS232/RS485 network is 256 bytes, and with TCP is 260 bytes. [8]
For data encoding, Modbus uses a big-endian representation for addresses and data fields. Thus, for a 16-bit value, the most significant byte is sent first. For example, when a 16-bit register has value 0x1234, byte 0x12 is sent before byte 0x34. [8]
Function code is 1 byte which gives the code of the function to execute. Function codes are integer values, ranging from 1 to 255, and the range from 128 to 255 is for exception responses.
The data field of the PDU has the address from 0 to 65535 (not to be confused with the address of the Additional address field of ADU). [9] The data field of the PDU can be empty, and then has a size of 0. In this case, the server will not request any information and the function code defines the function to be executed. If there is no error during the execution process, the data field of the ADU response from server to client will include the data requested, i.e. the data the client previously received. If there is any error, the server will respond with an exception code. [6]
A Modbus transaction between client and server includes: [6] [10]
Based on that, Modbus defines 3 PDU types: [8]
Modbus defines its data model based on a series of tables of four primary types: [11]
Primary tables | Access | Size | Features |
---|---|---|---|
Discrete input | R | 1 bit (0–1) | Read on/off value |
Coil (discrete output) [12] | R/W | 1 bit (0–1) | Read/Write on/off value |
Input register | R | 16 bit words (0–65,535) | Read measurements and statuses |
Holding register | R/W | 16 bit words (0–65,535) | Read/Write configuration values |
For each of the primary tables, the protocol allows individual selection of 65536 data items, and the operations of read or write of those items are designed to span multiple consecutive data items up to a data size limit which is dependent on the transaction function code. [11]
Modbus defines three types of function codes: Public, User-Defined and Reserved. [13]
Function type | Function name | Function code | Comment | ||
---|---|---|---|---|---|
Data Access | Bit access | Physical Discrete Inputs | Read Discrete Inputs | 2 | |
Internal Bits or Physical Coils | Read Coils | 1 | |||
Write Single Coil | 5 | ||||
Write Multiple Coils | 15 | ||||
16-bit access | Physical Input Registers | Read Input Registers | 4 | ||
Internal Registers or Physical Output Registers | Read Multiple Holding Registers | 3 | |||
Write Single Holding Register | 6 | ||||
Write Multiple Holding Registers | 16 | ||||
Read/Write Multiple Registers | 23 | ||||
Mask Write Register | 22 | ||||
Read FIFO Queue | 24 | ||||
File Record Access | Read File Record | 20 | |||
Write File Record | 21 | ||||
Diagnostics | Read Exception Status | 7 | serial only | ||
Diagnostic | 8 | serial only | |||
Get Com Event Counter | 11 | serial only | |||
Get Com Event Log | 12 | serial only | |||
Report Server ID | 17 | serial only | |||
Read Device Identification | 43 | ||||
Other | Encapsulated Interface Transport | 43 |
Note: Some sources use terminology that differs from the standard; for example Force Single Coil instead of Write Single Coil. [14]
Function code 01 (read coils) allows reading the state from 1 to 2000 coils of a remote device. mb_req_pdu (request PDU) will then have 2 bytes to indicate the address of the first coil to read (from 0x0000 to 0xFFFF), and 2 bytes to indicate the number of coils to read. mb_req_pdu defines coil address by index 0, i.e the first coil has address 0x0. On a successful execution, mb_rsp_pdu will return one byte to note the function code (0x01), followed by one byte to indicate the number of data bytes it is returning (n), which will be the number of coils requested by mb_req_pdu, divided by 8 bits per byte, and rounded up. The remainder of the response will be the specified number (n) of data bytes. [15] That is, the mb_req_pdu and mb_rsp_pdu of function code 01 will take the following form: [15]
For instance, mb_req_pdu and mb_rsp_pdu to read coils status from 20-38 will be: [16]
User-Defined Function Codes are function codes defined by users. Modbus gives two range of values for user-defined function codes: 65 to 72 and 100 to 110. Obviously, user-defined function codes are not unique. [13]
Reserved Function Codes are function codes used by some companies for legacy product and are not available for public use. [13]
When a client sends a request to a server, there can be four possible events for that request: [17]
Exception response message includes two other fields when compared to a normal response message: [17]
All Modbus exception code: [18]
Code | Text | Details |
---|---|---|
1 | Illegal Function | Function code received in the query is not recognized or allowed by server |
2 | Illegal Data Address | Data address of some or all the required entities are not allowed or do not exist in server |
3 | Illegal Data Value | Value is not accepted by server |
4 | Server Device Failure | Unrecoverable error occurred while server was attempting to perform requested action |
5 | Acknowledge | Server has accepted request and is processing it, but a long duration of time is required. This response is returned to prevent a timeout error from occurring in the client. client can next issue a Poll Program Complete message to determine whether processing is completed |
6 | Server Device Busy | Server is engaged in processing a long-duration command; client should retry later |
7 | Negative Acknowledge | Server cannot perform the programming functions; client should request diagnostic or error information from server |
8 | Memory Parity Error | Server detected a parity error in memory; client can retry the request |
10 | Gateway Path Unavailable | Specialized for Modbus gateways: indicates a misconfigured gateway |
11 | Gateway Target Device Failed to Respond | Specialized for Modbus gateways: sent when server fails to respond |
Modbus standard also defines Modbus over Serial Line, a protocol over the data link layer of the OSI model for the Modbus application layer protocol to be communicated over a serial bus. [19] Modbus Serial Line protocol is a master-slave protocol which supports one master and multiple slaves in the serial bus. [20] With Modbus protocol on the application layer, client/server model is used for the devices on the communication channel. With Modbus over Serial Line, client's role is implemented by master, and the server's role is implemented by slave. [20] [21]
The organization's naming convention inverts the common usage of having multiple clients and only one server. To avoid this confusion, the RS-485 transport layer uses the terms "node" or "device" instead of "server", and the "client" is not a "node". [21]
The (Modbus Organization) is using "client-server" to describe Modbus communications, characterized by communication between [client device (s), which initiates communication and makes requests of server device(s), which process requests and return an appropriate response (or error message).
A serial bus for Modbus over Serial Line can have a maximum of 247 slaves communicating with one master. Those slaves have a unique address ranging from 1 to 247 (decimal value). [22] The master doesn't need to have an address. [22] The communication process is initiated by the master, as only it can initiate a Modbus transaction. A slave will never transmit any data or perform any action without a request from the master, and slaves cannot communicate with each other. [23]
In Modbus over Serial Line, the master initiates requests to the slaves in unicast or broadcast modes. In unicast mode, the master will initiate a request to a single slave with a specific address. Upon receiving and finishing the request, the slave will respond with a message to the master. [22] In this mode, a Modbus transaction includes two messages: one request from the master and one reply from the slave. Each slave must have a unique address (from 1 to 247) to be addressed independently for the communication. [22] In broadcast mode, the master can send a request to all the slaves, using the broadcast address 0, [22] which is the address reserved for broadcast exchanges (and not the master address). Slaves must accept broadcast exchanges but must not respond. [23] The mapping of PDU of Modbus to the serial bus of Modbus over Serial Line protocol results in Modbus Serial Line PDU. [22]
Modbus Serial Line PDU = Address + PDU + CRC (or LRC)
With PDU = Function code + data
On the physical layer, MODBUS over Serial Line performs its communication on bit by RS485 or RS232, with TIA/EIA-485 Two-Wire interface as the most popular way. RS485 Four-Wire interface is also used. TIA/EIA-232-E (RS232) can also be used but is limited to point-to-point short-range communication. [20] MODBUS over Serial Line has two transmission modes RTU and ASCII which are corresponded to two versions of the protocol, known as Modbus RTU and Modbus ASCII. [24]
Modbus RTU (Remote Terminal Unit), which is the most common implementation available for Modbus, makes use of a compact, binary representation of the data for protocol communication. The RTU format follows the commands/data with a cyclic redundancy check checksum as an error check mechanism to ensure the reliability of data. A Modbus RTU message must be transmitted continuously without inter-character hesitations. Modbus messages are framed (separated) by idle (silent) periods. Each byte (8 bits) of data is sent as 11 bits: [3] [24]
A Modbus RTU frame then will be: [25]
Slave address | Function Code | Data | CRC |
---|---|---|---|
1 byte | 1 byte | 0 – 252 bytes | 2 bytes: 1 CRC low byte and 1 CRC high byte |
The CRC calculation is widely known as CRC-16-MODBUS, whose polynomial is x16 + x15 + x2 + 1 (normal hexadecimal algebraic polynomial being 8005
and reversed A001
). [26]
Example of a Modbus RTU frame in hexadecimal: 01 04 02 FF FF B8 80
(CRC-16-MODBUS calculation for the 5 bytes from 01
to FF
gives 80B8
, which is transmitted least significant byte first).
To ensure frame integrity during the transmission, the time interval between two frames must be at least the transmission time of 3.5 characters, and the time interval between two consecutive characters must be no more than the transmission time of 1.5 characters. [25] For example, with the default data rate of 19200 bit/s, the transmission times of 3.5 (t3.5) and 1.5 (t1.5) 11-bit characters are:
For higher data rates, Modbus RTU recommends to use the fixed values 750 μs for t1.5 and 1.750 ms for t3.5. [25]
Modbus ASCII makes use of ASCII characters for protocol communication. The ASCII format uses a longitudinal redundancy check checksum. Modbus ASCII messages are framed by a leading colon (":") and trailing newline (CR/LF).
A Modbus ASCII frame includes: [27]
Name | Length (bytes) | Function |
---|---|---|
Start | 1 | Colon : (ASCII value 3A16) |
Address | 2 | Station address |
Function | 2 | Indicates the function code e.g. "read coils" |
Data | n × 2 | Data + length will be filled depending on the message type |
LRC | 2 | Checksum (longitudinal redundancy check) |
End | 2 | Carriage return + line feed (CR/LF) pair (ASCII values 0D16 and 0A16) |
Address, Function, Data, and LRC are ASCII hexadecimal encoded values, whereby 8-bit values (0–255) are encoded as two human-readable ASCII characters from the ranges 0–9 and A–F. For example, a value of 122 (7A16) is encoded as two ASCII characters, "7" and "A", and transmitted as two bytes, 55
(3716, ASCII value for "7") and 65
(4116, ASCII value for "A").
LRC is calculated as the sum of 8-bit values (excluding the start and end characters), negated (two's complement) and encoded as an 8-bit value. For example, if Address, Function, and Data are 247, 3, 19, 137, 0, and 10, the two's complement of their sum (416) is −416; this trimmed to 8 bits is 96 (256 × 2 − 416 = 6016), giving the following 17 ASCII character frame: :F7031389000A60␍␊
. LRC is specified for use only as a checksum: because it is calculated on the encoded data rather than the transmitted characters, its 'longitudinal' characteristic is not available for use with parity bits to locate single-bit errors.
Modbus TCP or Modbus TCP/IP is a Modbus variant used for communications over TCP/IP networks, connecting over port 502. [28] It does not require a checksum calculation, as lower layers already provide checksum protection.
Modbus TCP nomenclature is the same as for the Modbus over Serial line protocol, as any device which send out a Modbus command, is the 'client' and the response comes from a 'server'. [29]
The ADU for Modbus TCP is officially called Modbus TCP/IP ADU by the Modbus organization [30] and is also called Modbus TCP frame by other parties. [3]
MODBUS TCP/IP ADU = MBAP Header + Function code + Data
Where MBAP - which stands for MODBUS Application Protocol header - is the dedicated header used on TCP/IP to identify the MODBUS Application Data Unit.
The MBAP Header contains the following fields: [31]
Name | Length (bytes) | Function |
---|---|---|
Transaction identifier | 2 | For synchronization between messages of server and client |
Protocol identifier | 2 | 0 for Modbus/TCP |
Length field | 2 | Number of remaining bytes in this frame |
Unit identifier | 1 | Server address (255 if not used), treated like slave address in Modbus over Serial line |
Unit identifier is used with Modbus TCP devices that are composites of several Modbus devices, e.g. Modbus TCP to Modbus RTU gateways. In such a case, the unit identifier is the Server Address of the device behind the gateway.
A MODBUS TCP/IP ADU/Modbus TCP frame format then will be: [31] [30]
Transaction identifier | Protocol identifier | Length | Unit identifier | Function code | Data |
---|---|---|---|---|---|
2 bytes | 2 bytes | 2 bytes | 1 byte | 1 byte | n bytes |
12 34 00 00 00 06 01 03 00 01 00 01
0x12
and 0x34
: With transaction ID = 0x1234 (2 bytes) as a "unique number" to be identified between the Modbus TCP client/server, the transaction ID High byte is 0x12 and transaction ID Low byte is 0x340x00
and 0x00
: Protocol identifier high byte and low byte0x00
and 0x06
: Length high byte and low byte. The length is 6 bytes which includes: unit identifier (slave address) (1 byte), function code (1 byte), high byte of the register address to read (1 byte), low byte of the register address to read (1 byte) and data (2 bytes = high byte and low byte of the number of registers to read)0x01
: Unit identifier (slave address)0x03
: Function code (Read Multiple Holding Registers)0x00
and 0x01
: high byte and low byte of the register address to read. The register address to read in this case is 0x0001
.0x00
and 0x01
: high byte and low byte of the number of registers to read. The number of registers to read in this case is 0x0001
. (i.e 1 register)Besides the widely used Modbus RTU, Modbus ASCII and Modbus TCP, there are many variants of Modbus protocols:
Data models and function calls are identical for the first four variants listed above; only the encapsulation is different. However the variants are not interoperable, nor are the frame formats.
Another de facto protocol closely related to Modbus appeared later, and was defined by PLC maker April Automates, the result of a collaborative effort between French companies Renault Automation and Merlin Gerin et Cie in 1985: JBUS. Differences between Modbus and JBUS at that time (number of entities, server stations) are now irrelevant as this protocol almost disappeared with the April PLC series, which AEG Schneider Automation bought in 1994 and then made obsolete. However, the name JBUS has survived to some extent.
JBUS supports function codes 1, 2, 3, 4, 5, 6, 15, and 16 and thus all the entities described above, although numbering is different:
The Internet Control Message Protocol (ICMP) is a supporting protocol in the Internet protocol suite. It is used by network devices, including routers, to send error messages and operational information indicating success or failure when communicating with another IP address. For example, an error is indicated when a requested service is not available or that a host or router could not be reached. ICMP differs from transport protocols such as TCP and UDP in that it is not typically used to exchange data between systems, nor is it regularly employed by end-user network applications.
The Open Systems Interconnection (OSI) model is a reference model from the International Organization for Standardization (ISO) that "provides a common basis for the coordination of standards development for the purpose of systems interconnection." In the OSI reference model, the communications between systems are split into seven different abstraction layers: Physical, Data Link, Network, Transport, Session, Presentation, and Application.
The Transmission Control Protocol (TCP) is one of the main protocols of the Internet protocol suite. It originated in the initial network implementation in which it complemented the Internet Protocol (IP). Therefore, the entire suite is commonly referred to as TCP/IP. TCP provides reliable, ordered, and error-checked delivery of a stream of octets (bytes) between applications running on hosts communicating via an IP network. Major internet applications such as the World Wide Web, email, remote administration, and file transfer rely on TCP, which is part of the transport layer of the TCP/IP suite. SSL/TLS often runs on top of TCP.
Telnet is a client/server application protocol that provides access to virtual terminals of remote systems on local area networks or the Internet. It is a protocol for bidirectional 8-bit communications. Its main goal was to connect terminal devices and terminal-oriented processes.
In computer networking, the User Datagram Protocol (UDP) is one of the core communication protocols of the Internet protocol suite used to send messages to other hosts on an Internet Protocol (IP) network. Within an IP network, UDP does not require prior communication to set up communication channels or data paths.
Trivial File Transfer Protocol (TFTP) is a simple lockstep File Transfer Protocol which allows a client to get a file from or put a file onto a remote host. One of its primary uses is in the early stages of nodes booting from a local area network. TFTP has been used for this application because it is very simple to implement.
The File Transfer Protocol (FTP) is a standard communication protocol used for the transfer of computer files from a server to a client on a computer network. FTP is built on a client–server model architecture using separate control and data connections between the client and the server. FTP users may authenticate themselves with a plain-text sign-in protocol, normally in the form of a username and password, but can connect anonymously if the server is configured to allow it. For secure transmission that protects the username and password, and encrypts the content, FTP is often secured with SSL/TLS (FTPS) or replaced with SSH File Transfer Protocol (SFTP).
OBEX is a communication protocol that facilitates the exchange of binary objects between devices. It is maintained by the Infrared Data Association but has also been adopted by the Bluetooth Special Interest Group and the SyncML wing of the Open Mobile Alliance (OMA). One of OBEX's earliest popular applications was in the Palm III. This PDA and its many successors use OBEX to exchange business cards, data, even applications.
SOCKS is an Internet protocol that exchanges network packets between a client and server through a proxy server. SOCKS5 optionally provides authentication so only authorized users may access a server. Practically, a SOCKS server proxies TCP connections to an arbitrary IP address, and provides a means for UDP packets to be forwarded. A SOCKS server accepts incoming client connection on TCP port 1080, as defined in RFC 1928.
Direct Client-to-Client (DCC) is an IRC-related sub-protocol enabling peers to interconnect using an IRC server for handshaking in order to exchange files or perform non-relayed chats. Once established, a typical DCC session runs independently from the IRC server. Originally designed to be used with ircII it is now supported by many IRC clients. Some peer-to-peer clients on napster-protocol servers also have DCC send/get capability, including TekNap, SunshineUN and Lopster. A variation of the DCC protocol called SDCC, also known as DCC SCHAT supports encrypted connections. An RFC specification on the use of DCC does not exist.
Client-to-client protocol (CTCP) is a special type of communication between Internet Relay Chat (IRC) clients.
The Line Printer Daemon protocol/Line Printer Remote protocol is a network printing protocol for submitting print jobs to a remote printer. The original implementation of LPD was in the Berkeley printing system in the BSD UNIX operating system; the LPRng project also supports that protocol. The Common Unix Printing System, which is more common on modern Linux distributions and also found on macOS, supports LPD as well as the Internet Printing Protocol (IPP). Commercial solutions are available that also use Berkeley printing protocol components, where more robust functionality and performance is necessary than is available from LPR/LPD alone. The LPD Protocol Specification is documented in RFC 1179.
A terminal server connects devices with a serial port to a local area network (LAN). Products marketed as terminal servers can be very simple devices that do not offer any security functionality, such as data encryption and user authentication. The primary application scenario is to enable serial devices to access network server applications, or vice versa, where security of the data on the LAN is not generally an issue. There are also many terminal servers on the market that have highly advanced security functionality to ensure that only qualified personnel can access various servers and that any data that is transmitted across the LAN, or over the Internet, is encrypted. Usually, companies that need a terminal server with these advanced functions want to remotely control, monitor, diagnose and troubleshoot equipment over a telecommunications network.
Real-Time Messaging Protocol (RTMP) is a communication protocol for streaming audio, video, and data over the Internet. Originally developed as a proprietary protocol by Macromedia for streaming between Flash Player and the Flash Communication Server, Adobe has released an incomplete version of the specification of the protocol for public use.
In computer networking, a port or port number is a number assigned to uniquely identify a connection endpoint and to direct data to a specific service. At the software level, within an operating system, a port is a logical construct that identifies a specific process or a type of network service. A port at the software level is identified for each transport protocol and address combination by the port number assigned to it. The most common transport protocols that use port numbers are the Transmission Control Protocol (TCP) and the User Datagram Protocol (UDP); those port numbers are 16-bit unsigned numbers.
Cisco HDLC (cHDLC) is an extension to the High-Level Data Link Control (HDLC) network protocol, and was created by Cisco Systems, Inc. HDLC is a bit-oriented synchronous data link layer protocol that was originally developed by the International Organization for Standardization (ISO). Often described as being a proprietary extension, the details of cHDLC have been widely distributed and the protocol has been implemented by many network equipment vendors. cHDLC extends HDLC with multi-protocol support.
An application delivery network (ADN) is a suite of technologies that, when deployed together, provide availability, security, visibility, and acceleration for Internet applications such as websites. ADN components provide supporting functionality that enables website content to be delivered to visitors and other users of that website, in a fast, secure, and reliable way.
The Data Stream Interface (DSI) is a session layer used to carry Apple Filing Protocol traffic over Transmission Control Protocol.
IEC 60870 part 5 is one of the IEC 60870 set of standards which define systems used for telecontrol in electrical engineering and power system automation applications. Part 5 provides a communication profile for sending basic telecontrol messages between two systems, which uses permanent directly connected data circuits between the systems. The IEC Technical Committee 57 have developed a protocol standard for telecontrol, teleprotection, and associated telecommunications for electric power systems. The result of this work is IEC 60870-5. Five documents specify the base IEC 60870-5:
{{cite web}}
: CS1 maint: postscript (link)