Modbus is a fieldbus, an industrial computer networking protocol. It was originally designed for use with programmable logic controllers (PLCs), but has become a de facto standard communication protocol for communication between industrial electronic devices in a wide range of buses and networks. Modbus is popular in industrial environments because it is openly published and royalty-free. It was developed for industrial applications, is relatively easy to deploy and maintain compared to other standards, and places few restrictions on the format of the data to be transmitted. The Modbus protocol uses serial communication lines, Ethernet, or the Internet protocol suite as a transport layer. Modbus supports communication to and from multiple devices connected to the same cable or Ethernet network. For example, there can be a device that measures temperature and another device to measure humidity connected to the same cable, both communicating measurements to the same computer, via Modbus. Modbus is often used to connect a plant/system supervisory computer with a remote terminal unit (RTU) in supervisory control and data acquisition (SCADA) systems. Many of the data types are named from industrial control of factory devices, such as ladder logic because of its use in driving relays: a single-bit physical output is called a coil, and a single-bit physical input is called a discrete input or a contact. It was originally published in 1979 by Modicon (bought by Schneider Electric in 1997). In 2004, they transferred the rights to the Modbus Organization which is a trade association of users and suppliers of Modbus-compliant devices that advocates for the continued use of the technology.
Protocol description
Modbus standards or buses include:
TCP/IP over Ethernet Asynchronous serial communication in a wide range of standards, technologies: EIA/TIA-232-E, EIA-422, EIA/TIA-485-A, fiber, radio frequency,... MODBUS PLUS, a high speed token passing network.
To support Modbus communication on a network, many modems and gateways incorporate proprietary designs (refer to the diagram: Architecture of a network for Modbus communication). Implementations may deploy either wireline or wireless communication, such as in the ISM radio band, and even Short Message Service (SMS) or General Packet Radio Service (GPRS).
PDU and ADU Modbus defines a client which is an entity that initiates a transaction to request any specific task from its request receiver. The client's "request receiver", which the client has initiated the transaction with, is then called the server. For example, when a microcontroller connects to a sensor to read its data by Modbus on a wired network, e.g RS485 bus, the MCU in this context is the client and the sensor is the server. In former terminology, the client was named master and the server named slave. Modbus defines a protocol data unit (PDU) independently to its lower layer protocols in its protocol stack. Mapping MODBUS protocol on specific buses or networks requires some additional fields, defined as the application data unit (ADU). The ADU is formed by a client inside a Modbus network when the client initiates a transaction. Contents are:
PDU = Function code + data ADU = Additional address + PDU + error check The ADU is officially called a Modbus frame by the Modbus Organization, although frame is used as the data unit in the data-link layer in the OSI and TCP/IP model (while Modbus is an application layer protocol). PDU max size is 253 bytes. ADU max size on RS232/RS485 network is 256 bytes, and with TCP is 260 bytes. For data encoding, Modbus uses a big-endian representation for addresses and data fields. Thus, for a 16-bit value, the most significant byte is sent first. For example, when a 16-bit register has value 0x1234, byte 0x12 is sent before byte 0x34. Function code is 1 byte which gives the code of the function to execute. Function codes are integer values, ranging from 1 to 255, and the range from 128 to 255 is for exception responses. The data field of the PDU has the address from 0 to 65535 (not to be confused with the address of the Additional address field of ADU). The data field of the PDU can be empty, and then has a size of 0. In this case, the server will not request any information and the function code defines the function to be executed. If there is no error during the execution process, the data field of the ADU response from server to client will include the data requested, i.e. the data the client previously received. If there is any error, the server will respond with an exception code.
Modbus transaction and PDU A Modbus transaction between client and server includes:
Step 1: Client initiates a request with PDU = Function code + data request Step 2: Server receives the request from client. Server will then read/parse the function code, get the address of the data field of the PDU, then get this data field value and finally perform the action based on the function code. If there is no error during those steps, the server will respond with PDU = Function code + data response. As long as there is no error during those steps, the server's responding function code will also be the function code sent from the client. If there is any error during those steps, the server will respond with PDU = Exception Function code + Exception code (Reference to PDU mb_excep_rsp_pdu defined below). Step 3: Client receives the response and ends the transaction. Based on that, Modbus defines 3 PDU types:
MODBUS Request PDU, mb_req_pdu MODBUS Response PDU, mb_rsp_pdu MODBUS Exception Response PDU, mb_excep_rsp_pdu mb_req_pdu = Function code (1 byte) + request data (n bytes) request data field's size depends on the function code and usually includes values like variable values, data offset, and sub-function codes. mb_rsp_pdu = Function code (1 byte) + response data (n bytes) As in mb_req_pdu, response data field's size depends on the function code and usually includes values like variable values, data offset, and sub-function codes. mb_excep_rsp_pdu = Exception Function code (1 byte) + exception code (1 byte) Exception Function code = Function code (1 byte) + 0x80. Exception Function code is equal to the Function code, except that its MSB is set to 1. Exception code (1 byte) of mb_excep_rsp_pdu is defined in the MODBUS Exception Codes table.
Modbus data model Modbus defines its data model based on a series of tables of four primary types:
… excerpt ends here. Continue reading the full article.




