0% found this document useful (0 votes)
909 views

Modbus Book Chapters 1 3

This document provides an overview of a book titled "The Everyman's Guide to Modbus" which discusses the Modbus protocol. Some key points: - Modbus has remained a relevant protocol for automation and industrial control for over 30 years since its creation in 1979, despite newer technologies emerging. - The book is intended as an introductory guide to Modbus and how it works for people involved in automation, including details on its history, architecture, data representation, transport layers, functions, and applications in software and industry. - Modbus has seen enduring success due to its simplicity, ease of implementation, and open standard which allows anyone to use it for connecting automation devices and systems. It has become

Uploaded by

samu66oar
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
0% found this document useful (0 votes)
909 views

Modbus Book Chapters 1 3

This document provides an overview of a book titled "The Everyman's Guide to Modbus" which discusses the Modbus protocol. Some key points: - Modbus has remained a relevant protocol for automation and industrial control for over 30 years since its creation in 1979, despite newer technologies emerging. - The book is intended as an introductory guide to Modbus and how it works for people involved in automation, including details on its history, architecture, data representation, transport layers, functions, and applications in software and industry. - Modbus has seen enduring success due to its simplicity, ease of implementation, and open standard which allows anyone to use it for connecting automation devices and systems. It has become

Uploaded by

samu66oar
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 34

MODBUS

The Everyman’s Guide to a


Protocol That Has Stayed
Relevant in Automation for
Over 30 years

JOHN RINALDI
JOHN RINALDI

Copyright © 2015 JOHN RINALDI

All rights reserved.

ISBN-13: 978-1517764685
ISBN-10: 1517764688
THE EVERYMAN’S GUIDE TO MODBUS

DEDICATION

To the Automation Engineer, the unsung


hero of American Manufacturing.
JOHN RINALDI
THE EVERYMAN’S GUIDE TO MODBUS

TABLE OF CONTENTS
DEDICATION ......................................................... iii
TABLE OF CONTENTS ...........................................v
TABLE OF FIGURES ............................................. vii
TABLE OF TABLES................................................ vii
ACKNOWLEDGMENTS .......................................... i
FOREWORD .............................................................. 3
INTRODUCTION..................................................... 7
A LITTLE MODBUS HISTORY ............................. 13
WHY MODBUS HAS FLOURISHED .................... 16
MODBUS DATA REPRESENTATION ................. 21
MODBUS TRANSPORT LAYERS ......................... 26
MODBUS – THE DETAILS..................................... 35
MODBUS FOR SOFTWARE DEVELOPERS ........ 51
MODBUS ROUTERS .............................................. 57
THE MODBUS ORGANIZATION ........................ 63
MODBUS CERTIFICATION.................................. 67
MODBUS PLUS........................................................ 70
MODBUS & OTHER PROTOCOLS...................... 72
MODBUS & OPC UA.............................................. 79
MODBUS WILL LIVE FOREVER .......................... 83
MODBUS & REAL TIME AUTOMATION .......... 86

ABOUT THE AUTHOR ........................................ 92


JOHN RINALDI

TABLE OF FIGURES
Figure 1 - Typical Relay Panel ................................... 14
Figure 2 - Master/Slave Modbus Architecture............ 18
Figure 3 - Modbus Message Structure ......................... 27
Figure 4 - Serial Modbus Message Structure ............... 49
Figure 5 - Modbus TCP Message Structure ................ 49
Figure 6 - Elecsan Headquarters ................................. 58
Figure 7 - Elecsan Remote Monitoring Architecture .60
Figure 8 - Modbus Organization Membership Logo .. 66

TABLE OF TABLES
Table 1 - Modbus Message Components .................... 37
Table 2 – Read Coil Structure .................................... 37
Table 3 – Read Input Coil Structure .......................... 38
Table 4 – Read Holding Registers Structure ............... 39
Table 5 – Read Input Registers Structure ................... 40
Table 6 – Write Single Coil Structure ........................ 41
Table 7 – Write Single Register Structure................... 42
Table 8 – Write Multiple Coil Structures ................... 43
Table 9 – Write Multiple Registers Structure ............. 44
Table 10 – Read/Write Register Structure ................. 45

vii
THE EVERYMAN’S GUIDE TO MODBUS

vi
JOHN RINALDI

ACKNOWLEDGMENTS
This book would not be possible without the
dedication, friendship, persistence, support and follow
through of the entire staff at Real Time Automation.
Specifically, to Drew Baryenbruch for pushing me to do
this book and freeing me of daily sales and marketing so
that I can take on projects like this.

By reading and accepting this information you agree to all of the


following: You understand that this is simply a set of opinions (and
not advice). This is to be used for entertainment, and not considered

ii
THE EVERYMAN’S GUIDE TO MODBUS

as "professional" advice. You are responsible for any use of this


information in this work and hold the author and all members and
affiliates harmless in any claim or event.

i
THE EVERYMAN’S GUIDE TO MODBUS

FOREWORD
Modbus Changed the World!

The Modbus communications protocol is the


networking granddaddy of the industry and is still the
only open source electronic networking protocol for
connecting automation systems. Modbus has stood the
test of time and is still being used in a wide range of
applications, including industrial automation, process
control, building automation, transportation, energy,
and remote monitoring. Virtually any type of sensor and
controller devices can be found that incorporate Modbus
networking, including programmable logic controllers
(PLCs), process controllers, process instruments, process
sensors, PID controllers, motor drives, energy meters,
Supervisory Control and Data Acquisition (SCADA)
systems, programmable automation controllers (PACs),
discrete sensors, valves, and many other embedded
devices.
The key to the success of Modbus includes simplicity,

3
JOHN RINALDI

ease of implementation, and open source for anyone to


use. Modbus is used throughout the world, and
understanding how to apply it as described in this book
is important for any person involved in the automation
industry.
The Modbus serial communication protocol was
developed by Modicon and published by the company in
1979 for use with its programmable logic controllers
(PLCs). The early roots of Modicon started in 1968 with
a core group of engineers led by Dick Morley that
invented the first programmable logic controller.
In simple terms, Modbus is a method used for
transmitting information over serial lines between
electronic devices. Originally intended for
communications between programmable logic
controllers (PLCs) and computers, it has become a de
facto standard communication protocol for connecting a
wide range of industrial electronic devices.
Modbus is an extremely compact and flexible
protocol that continues to prove it can be adapted for use
in a wide range of applications and media.
Modbus is popular for remote applications that
communicate over almost any means, including wired
and cellular telephone, licensed and unlicensed radios,
and satellite. Developers have used Modbus to leverage
other wireless communications technologies, such as in
the Industrial, Scientific and Medical (ISM) radio band,
short message service (SMS), General Packet Radio
Service (GPRS), and Mesh networking (802.15.4).
Modbus is incorporated into Remote Terminal Devices
(RTUs), used in applications including water/waste
water, oil & gas, electric power utility, cell tower
monitoring, and tank monitoring.

4
THE EVERYMAN’S GUIDE TO MODBUS

In November 2007, ODVA extended the CIP


Networks Library of specifications to provide
compatibility of Modbus TCP devices by extending the
Common Industrial Protocol (CIP) Network
specifications to provide compatibility of Modbus/TCP
devices with networks built on the CIP. This extension
provides Modbus/TCP users a clear path to integrate
with CIP network architectures. Users benefit through
interoperability between the EtherNet/IP and
Modbus/TCP devices.
Illustrating the pervasiveness and flexibility of
Modbus, the Semiconductor Equipment and Materials
International (SEMI) global industry association serving
the nano- and microelectronic manufacturing industry in
response to customer demand implemented a Network
Communication Standard and an Object Messaging
Protocol using Modbus TCP/IP. This allows sensors
conforming to the organizations SEMI Sensor Bus
Standard to communicate with each other using Modbus
TCP/IP.
It is almost impossible to walk into a manufacturing
plant, process plant, oil platform, commercial building,
ship, or other area where there is automation, sensors,
and controls that do not have devices communication
using Modbus. Modbus is not industry specific and is
continually being adapted for use in a wide range of
applications. Modbus/TCP is a compact protocol that
can be used with new low cost processors that
incorporate communications being embedded in sensors
and other edge devices. Modbus has stood the test of time
and will continue to be used for years to come.

William Lydon

5
JOHN RINALDI

Editor, Automation.com
May, 2015

6
THE EVERYMAN’S GUIDE TO MODBUS

INTRODUCTION

A Book on Modbus?

When I was approached to write a book on Modbus


in 2015, I dismissed the idea outright. Writing a book on
Modbus in the age of new factory floor platforms like
mobile phones and tablets, new technologies like OPC
UA, new businesses paradigms from the Internet of
Things (IOT) and the ever present march toward
integration between the Enterprise and factory floor just
seemed silly.
It seemed to be as useful as writing about different
models of buggy whips, the rotary telephone, or that new
innovation, color television. What is there to say? What
hasn’t been said about Modbus over the last 40 years?
Modbus is hardly a new technology. Historians can
disagree about its actual birth, but it’s certainly a product
born of the 1970s. Success is such a trite word for how
well it’s done over those 40 years.
Modbus has found its way into hundreds of

7
JOHN RINALDI

thousands—if not millions—of devices. You can find it in


everything from valve controllers, to motor drives, to
HMIs, to water filtration systems. It would be difficult
indeed to name a product category in Industrial or
Building Automation that doesn’t use Modbus.
Yet even in the automation world, Modbus isn’t just
old technology. IT’S ANCIENT TECHNOLOGY.
Modbus is like that loveable old uncle that comes over
every Thanksgiving. He’s retired now, he putters around
his garden, he’s no longer the handsome debonair man of
40 years ago, but he’s there when we need him and that’s
why we love him.
Prior to Modbus, all we had was electrical signaling.
For digital input and output devices like pushbuttons,
lights, motors and the like, we wired a signal wire and a
return from the controller to the device. For analog input
devices like a temperature sensor or output devices like
drive speed, we used 0-10 Volts, 4-20ma current loop or
RTD. Everything was wired, everything was either a
voltage level, a current level, or simply a binary input or
output. With thousands of inputs and outputs in a big
manufacturing machine, the labor to install all those
wires, check that every single one of them was
terminated to the right position, and test each one took
weeks and sometimes months of effort.
In those days, the concept of data, let alone
information, just didn’t exist. We had inputs. We had
outputs. Even things that cried out for digital control had
to be wired as an analog. Drive speed couldn’t be
specified as 100 RPM. Instead it was specified as a 0 to 10
Volt output with the precision of that output defining
how precisely you could control a speed. Luckily,
everything else was pretty crude too so we didn’t need

8
THE EVERYMAN’S GUIDE TO MODBUS

very precise control a lot of the time.


But Modbus changed all that. Modbus changed
everything. Modbus introduced the concept of data on
the factory floor. Modbus made it possible to connect an
entire group of devices using only two wires on the
controller. That alone saved a massive investment in
wire, labor and installation time. Instead of miles and
miles of wire connecting hundreds of devices, a simple
two-wire pair could be daisy-chained from one device to
the next to the next. It was revolutionary for its time.
It wasn’t just that Modbus was the first serial
protocol. Modbus was the right technology at the right
time. You have to remember that the first
microprocessor wasn’t invented until shortly before the
birth of Modbus. Do you remember what those
microprocessors were like? Simple 8-bit processors with
severely limited code space and memory.
I remember those days. In one of my first installations
on a packaging machine in Canada we had 128 bytes of
RAM and I manually tracked every single one of those
128 8-bit RAM locations. For example, I tracked byte 14
and knew that it was only used in the first section of the
program so that I could reuse it for something else later
in the program. Try to imagine how revolutionary
Modbus was in this kind of automation environment.
And that’s why Modbus achieved so much early
success. Its raw simplicity made it the preferred
implementation for many other protocols. It had a
number of distinct advantages:
1. Modicon Sponsorship – It didn’t hurt Modbus
that one of the biggest PLC manufacturers at the
time created Modbus and made it open and
widely available.

9
JOHN RINALDI

2. Simple Data Representation – Modbus has only


two basic data types, 16-bit unsigned integer
(known as a register) and a single bit (known as a
coil).
3. Simple Request/Response Command
Structure – Modbus has a simple read and write
for each of its different data types.
4. Low Resource Requirements – Modbus
requires very little in the way of processor code
space or RAM. This isn’t as important today
given the powerful processors and technology
available to us, but it was very important in the
early years of industrial automation when
processors used 8-bit technology and resources
like RAM and ROM were extremely expensive
and scarce.
5. Serial Transport Layer – Modbus uses RS485
serial communications to move bits from one
place to another. This means that any processor
can implement Modbus without any special
hardware. All you need is a simple and
inexpensive RS485 driver chip to be in the
Modbus business.
6. Message Checking – CRC and LRC checking
mean that transmission errors are checked to
99% accuracy.

But the other side of the coin is that all this simplicity
leads to some distinct disadvantages including:
1. No Device Profiles

10
THE EVERYMAN’S GUIDE TO MODBUS

2. Limited data types


3. RS485 problems and troubleshooting difficulty
4. Small packet size
5. Small network size
So, if Modbus is so simple and has been successfully
implemented thousands of times over, do we really need
another book on Modbus? Well, yes.
We live in a new age. The age of enterprise
communications. It’s an age where automation and the
factory floor are changing in ways that weren’t
imaginable just a few short years ago. Today, IT and IT
technologies are rapidly moving on to the factory floor.
The push to totally integrate business from the lowest
sensor to the most extensive business system is
irreversible. New technologies, new processes, new kinds
of organizations and new systems are upon us in ways
we’ve never imagined.
And despite all this, Modbus is still going to be with
us. Modbus devices have permeated every kind of
automation and will continue to over the next hundred
years due to their simplicity and because they’re perfect
for a lot of simple devices.
This book describes these changes and the role that
Modbus will continue to play. It’s been successful for
forty years now it will continue to be successful over the
next forty.

John Rinaldi
June 1, 2015
Paris, France

11
JOHN RINALDI

An audio interview with the


author is available on the resources web page for this
book. Just visit either of the following web pages:
http://www.rtaautomation.com/technologies/modbus-
rtu/
http://www.rtaautomation.com/technologies/modbus-
tcpip/

12
THE EVERYMAN’S GUIDE TO MODBUS

A LITTLE MODBUS HISTORY

You might call the Modbus protocol the grandfather


of industrial networking. It truly is as old as the hills and
has the whiskers to prove it. In today’s age of Internet
connectivity and Web Services, Modbus’ unconnected
message and simple request-response communication
structure is almost quaint. Almost as old as the first
Programmable Logic Controller, the Modicon 084,
which in those days was called a PC for Programmable
Controller.
Modbus is an open standard, meaning that
manufacturers can build it into their equipment without
having to pay royalties. It is the most pervasive
communications protocol in industrial automation, and
is now the most commonly available means of
connecting industrial electronic devices.
Modbus is used widely by many manufacturers
throughout many industries. Modbus is typically used to
transmit data from control instrumentation to a logic
controller or a system for archiving data. In building

13
JOHN RINALDI

automation, for example, temperature and humidity are


often communicated to a computer for long term
storage. Modbus is often used to connect a supervisory
computer with a remote terminal unit (RTU) in
supervisory control and data acquisition (SCADA)
systems.
Before Programmable Controllers, Control
Engineers did relay control. Hardwired relays on the
wall acted as the machine logic. There were rooms with
walls full of relays, terminal blocks and more wire than
you could easily measure.

Figure 1 - Typical Relay Panel

The walls came to be organized with power lines


down the sides connecting various control inputs to
various kinds of output relays. The structures began to
look like ladders so the term “ladder logic” came to
represent that kind of control logic.
This wasn’t, as you might say, optimum. The
problems were many, including:
• A massive amount of time required to change the
control logic. To do it properly you moved the
control inputs and output relays around. To do it
quickly you just rewired it, creating a control system
that couldn’t be understood.

14
THE EVERYMAN’S GUIDE TO MODBUS

• These control rooms weren’t ventilated properly.


Control Engineers at the time didn’t have the know-
how to make good terminations. Contacts often
failed as they became worn or dirty and machine
downtime from loose wires was common.
• A complete lack of systems to document the control
system.
It was common to spend hours and hours to track
down a problem which
could be fixed in 10
seconds by wiping off a Did You Know?
contact. The first PLC’s
This was the era that
were called PC’s,
birthed the PLC. Richard
Morley and several which stood for
associates founded the Programmable
Modicon Corporation in Controller
the 1968. They
introduced the first
Programmable Controller, the “084,” so named because
it was the 84th project at Bedford and Associates, the
company they had left to found Modicon.
Ten years after that first PLC and after a few
successors to the 084, Modicon introduced Modbus, the
world’s first industrial communication network and
arguably the most successful. Modbus connected those
Modicon PLCs to each other and to remote devices
starting a whole new era in factory floor connectivity.
Yet beyond being an originating standard bearer for
communication protocols, it also remains relevant to
many applications and systems today.

15
JOHN RINALDI

Did you know there is a cool gift you can


grab just for visiting the resources page for this book?
http://www.rtaautomation.com/modbus/gift

WHY MODBUS HAS FLOURISHED

Modbus, as we learned in the last chapter, is the most


pervasive communications protocol in industrial and
building automation and the most commonly available
means of connecting automated electronic devices.
Why did that happen? Why did Modbus have such an
impact on the Industrial Automation industry that it
survives to this day as one of the leading industrial
networks of the 21st century? There are three primary

16
THE EVERYMAN’S GUIDE TO MODBUS

keys to its success.

Modbus Is an Open Standard


Modicon did not keep the standard proprietary. They
released it as a non-proprietary standard and welcomed
developers, even competitors, to implement it. They
rightly assumed that it would be best for everyone,
including them, if Modbus became successful in the
marketplace. Because of this thinking, Modbus became
the first widely accepted fieldbus standard. In a short
time, hundreds of vendors implemented the Modbus
messaging system in their devices and Modbus became
the de facto standard for industrial communication
networks.

Modbus Uses Standard Transports


The transport layer for Modbus RTU commands is
also simple to understand. It uses RS485, a differential
communication standard which supports up to 32 nodes
in a multi-dropped bus configuration. RS485 provided
superior noise immunity than the RS232 electrical
standard.

Modbus Uses a Simple Protocol


Modbus is very easy to understand. Its primary
purpose is to simply move data between a RTU Master
device (a Client in Modbus TCP) and an RTU Slave
device (a Server in Modbus TCP). There are only two
kinds of data to move, registers and coils. Registers are
16-bit unsigned integers. Coils are single bits.

17
JOHN RINALDI

MASTER SLAVE
Initiate Request

Function Code Data Action / Build Response

Response Code Data

Process Response

Figure 2 - Master/Slave Modbus Architecture

Modbus uses a very straightforward Request-


Response command structure. A Modbus Master
requests or sends data to a Slave and the Slave responds.
There are simple commands to read a register, read a coil,
write a register and write a coil.
Complete simplicity was extremely important when
the protocol was released. Remember that
microprocessor technology when Modbus was created
was not only brand new, but extremely limited.
Programmers often had as little as 64 bytes to manage.
That’s 64 b-y-t-e-s, not 64K or 64Meg. Developing an
automation app with just 64 bytes of RAM meant that
every single byte was treasured. There just weren’t any
bytes to frivolously waste.
Modbus fit well in that area. It required little code
space, often as little as 1K. RAM varied with the size of
your data space. Simple automation devices with little
bits of data—imagine a photo eye—could be implemented
with hardly any RAM space. These devices could now,
for the first time, send their data to a control system as
part of a daisy-chained 485 network, avoiding hardwired
point-to-point communications.

18
THE EVERYMAN’S GUIDE TO MODBUS

Another reason Modbus was


so successful was the fact that it
Did You Know? could be so readily understood
Before it’s by non-programmers. Engineers
downfall, Enron that built glue machines, meters,
measuring devices and such
had its own
could easily understand the
version of concept of coils/registers and the
Modbus simple commands to read and
write them.
The simplicity of Modbus has
been both a blessing and a curse over the years. The
simplicity has led to an incredible amount of activity and
propagation of Modbus into many different industries
around the world. There is probably no product category
in the last thirty years that hasn’t had an offering without
Modbus.
The simplicity of Modbus has also led to many
companies expanding the message structure, data
representation and transports. Some vendors have
imposed any number of advanced structures and data
types on the basic Modbus address structure. Others have
used Modbus in other ways that go beyond the basic
specification.
These implementation extensions are not expressly
prohibited by the specification, but don’t always make
Modbus easily portable to many different applications.
In spite of this, Modbus has gained wide market
acceptance wherever Industrial Automation Systems
(IAS) or Building Management Systems (BMS) need to
communicate with other devices. In fact, Modbus is
probably the most implemented automation protocol of
all time.

19
JOHN RINALDI

20
THE EVERYMAN’S GUIDE TO MODBUS

MODBUS DATA REPRESENTATION


In the movie City Slickers, the old cowboy Curly (Jack
Palance) tells Mitch (Billy Crystal), the secret of life.
“One thing. Just one thing,” he says—but that you need
to figure it out for yourself. And it’s what makes life
meaningful again for Mitch when he realizes that his wife
and children are all that really matter to him.
Well, Modbus isn’t the answer to the secret of life. But
I can tell you the one pseudo-secret that’s the key to
understanding Modbus. Actually the key to
understanding DeviceNet, PROFIBUS, EtherNet/IP,
PROFINET IO and every other protocol. And that’s the
data representation. If you understand the data
representation for a protocol, you’re 80% of the way to
understanding what that communications protocol does
and how it does it.
Like everything else about Modbus, the data
representation is pretty simple. In fact, data is
represented more simply in Modbus than in any other
industrial protocol you’ll ever find.

21
JOHN RINALDI

There are only two data types in Modbus: coils and


registers.

Coils:
Coils are simply single bits. The bits can be ON (1) or
they can be OFF (0). Some coils represents inputs,
meaning they contain the status of some physical discrete
input. Or they represent outputs, meaning that they hold
the state of some physical discrete output signal.

Registers:
Registers are simply 16-bit unsigned register data.
Registers can have a value from 0 to 65535 (0 to FFFF
hexadecimal). There is no representation for negative
values, no representation for values greater than 65535,
and no representation for real data like 200.125.
Applications can impose these representations on
registers. For example, a register can treat two registers,
the first containing 200 and the second containing 125, as
200.125. Or an application can group four registers and
place a 64-bit IEEE floating point bit pattern in those
registers. Any application can organize and treat register
data in any way it may want, but there is no way for any
other Modbus device to automatically know what that
representation is. A Modbus application that reads
registers from a Modbus Slave device must have some
prior knowledge of how particular registers are treated
to process them correctly.
Registers are grouped into Input Registers and
Holding Registers. Like Input Coils, Input Registers
report the state of some external input as a value between
0 and 65535. The original intent of an Input Register was

22
THE EVERYMAN’S GUIDE TO MODBUS

to reflect the value of some analog input. It is a digital


representation of an analog signal like a voltage or a
current. Most Modbus devices today are not I/O devices,
and Input Registers simply function identically to
Holding Registers.
Holding Registers were originally designed as
temporary program storage for devices like Modbus
controllers. Today, Holding Registers function as data
storage for devices.
Both Modbus registers and coils are addressed with
the first register or coil as Address 1 and the last as
Address 65536. That means that there can be up to 65536
(10000 Hex) Input Registers, 65536 Output Registers,
65536 Input Coils and 65536 Status Coils, but most
devices use far fewer. Often you will find no coils in a
device, and sometimes as few as 10 Holding Registers.
A lot of novice Modbus users find the address space
notation used in Modbus confusing. Modbus includes the
address space type with the index in the address space.
The typical address space notation used in Modbus
follows:
0x is Status Coil Address Space from 00000 to 065535
1x is Input Coil Address Space from 10000 to 165535
3x is Input Register Address Space from 30000 to 365535
4x is Holding Register Address Space from 40000 to 465535
So, when you see a notation that some value is at
Modbus Register 40010, you know that the value is
stored in a Holding Register at offset 10, the 11th value,
in the Holding Register area of the device. The reason
that this is important is that there are specific Modbus
functions that operate on specific areas of the address

23
JOHN RINALDI

space. There is a read Holding Register command that


always reads registers in the 4x address space. There is a
Write Single Coil Register that only writes coils in the 0x
address space.
What’s important to note about this data addressing
is that the coil addressing is specifying bit addresses, while
register addresses specify 16-bit unsigned integer values.
Input Coil address 2 is a bit address. It’s the third bit of
the coil address space. Input Holding Register address 2
is the address of a 16-bit value. It’s the third value of the
Holding Register address space.
The commands that operate on these address spaces
reflect those data types. A command to read coils
specifying a length of 3 is going to return 8 bits, of which
only 3 will be valid. Coil Address 3 for a length of 3
returns coils 3, 4 and 5. A command to read registers
specifying a length of 3 returns three 16-bit values. It
returns the values of registers 3, 4 and 5.
Write commands work in the opposite direction.
When writing three coils, you must specify the three bits
you want to write as the first three bits of the input data
in the command. But when writing three registers, you
must supply three 16-bit values.
Other than some awkward notation that is a left over
from the era when Modicon Inc. designed the protocol,
the Modbus data representation is very simple and
straightforward. When a Modbus device is designed, the
designer makes a decision of not only how many registers
or coils are needed, but also which address space to use
(Input Coil, Status Coil, Input Register, Holding
Register) and where in that address space to locate those
values. A designer may have only 10 bits of coil data and
2 registers. Those bits and registers can be located

24
THE EVERYMAN’S GUIDE TO MODBUS

anywhere in the Modbus address space.


That example points to one of the deficiencies of this
data representation. There are no standards. There is no
way to communicate to the user of the device any meta-
data. If the value of register 40100 is a temperature, there
is no standard way to communicate the meaning of
register 40100 and how to interpret the data. The user has
no information to know if a value of 1001 means 100.1
degrees or 10.01 degrees or 1001 degrees.
And there is no standard regarding device profiles.
Another temperature controller may store its
temperature at 40200 and use a completely different data
interpretation.
The Modbus data representation is simple and almost
standards-free. That is both a blessing and a curse to those
of us who still use Modbus on a daily basis.

25
JOHN RINALDI

Hey there.

Want to read more of


The Everyman’s Guide to
Modbus?

Buy it here on Amazon today!

26

You might also like