Modbus Protocol User Guide: Revision C January 3, 2006 Part Number GC-800-250
Modbus Protocol User Guide: Revision C January 3, 2006 Part Number GC-800-250
User Guide
The information in this guide may change without notice. The manufacturer assumes no
responsibility for any errors that may appear in this guide.
1.1 Modbus
When it comes to planning data communication for open, multi-vendor industrial control systems, Modbus™
is the undisputed first choice of end users and integrators alike. The Modbus/RTU protocol defines how a
“master” device polls one or more “slave” devices to read and write data in real time over RS-232, RS-422,
or RS-485 serial data communication. Although not the most powerful protocol available, its rare simplicity
allows not only rapid implementation but also enough flexibility to be applied in a large number of
industrial situations. Modbus/TCP, an extension of Modbus/RTU, defines how Modbus/RTU and
Modbus/ASCII messages are encoded within and transported over TCP/IP-based networks. Modbus/TCP is
just as simple to implement and flexible to apply as the original Modbus/RTU. You can find the
specification for both online at www.modicon.com.
The XPort-MB Device Server allows users to integrate new and existing Modbus/RTU and Modbus/ASCII
serial devices to newer TCP/IP network-based devices. The next section describes a system that integrates
four Modbus/RTU devices with four Modbus/TCP devices.
™
Modbus is a registered trademark of Schneider Automation.
A B C Device Server
Modbus
Modbus/RTU or
D Modbus/ASCII G H
Figure 1 - Extended Modbus System Example
In Figure 1, we can see four specific styles of Modbus operations. Modbus/RTU devices are traditionally
split into two groups.
Modbus slave devices generally are the workhorse devices. Often industrially hardened, they tirelessly
perform their tasks 24 hours a day, 365 days a year. They perform tasks such as flow metering, temperature
control, batch loading, or even running entire automated assembly lines. The slave devices are not called
“slaves” because they work all the time; they are called slaves because as far as the data communications is
concerned, they function as passive servers. Modbus slave devices passively sit and wait for a remote
Modbus master device to ask them to report existing data values (Read) or accept new data values (Write).
Modbus master devices generally are higher-level computers, devices in which data and software are very
important. The most common examples of Modbus master devices are the “Human-Machine-Interface”
(HMI) computers, which allow human operators to monitor, adjust, and maintain the operations of the field
devices. Modbus master devices are clients that actively go out and “Read” from and/or “Write” to remote
Modbus slave devices to monitor or adjust slave behavior.
2.3 IP Address
Every device connected to the TCP/IP network including the XPort-MB Device Server must have a unique
IP address. When multiple Modbus devices share a single IP, then Modbus/TCP includes an additional
address called the Unit ID.
When the XPort-MB Device Server is receiving Modbus/TCP messages from remote masters, the Unit ID is
converted to use in the Modbus/RTU message as the slave address.
When the XPort-MB Device Server is receiving Modbus/RTU messages from local serial masters, a user-
defined lookup table is used to match the 8-bit Modbus slave address to a remote IP address. The Modbus
slave address received is used as the Unit ID.
Do not enter any extra spaces or lines. Save the file and start Device Installer. The program will locate the
XPort-MB and display XPort-03 Modbus.
To search for devices, click the Search icon or select Search F5 from the Device menu.
You can use the Assign IP, Upgrade and the Telnet buttons.
Note: The Web manager page has been deleted from the firmware so the Web button does not work.
Note: Do NOT use the Configure button for changing the Baud Rate.
1. From the DeviceInstaller Configuration Utility, click the Telnet button to open a Telnet
connection to the XPort-MB Device Server. You’ll see the following lines, which tell you the Device
Server’s Ethernet hardware address (or HW MAC).
*Modbus/TCP to RTU Bridge
MAC address 00204A81DA6D
Software version 02.2b1 (040728) XPTEX
Press Enter to go into Setup Mode, wait to close
2. Within 5 seconds, press Enter to display the Setup (configuration) Mode screen. Here you can change
the parameters that define how the XPort-MB Device Server does its job.
Note: When you set up a new unit, and especially if you just reflashed the unit with a new firmware type, we
recommend that you reset all of the parameters to the factory defaults.
3. To reset the parameters to the factory defaults, type D on the command line and press Enter. The default
parameters display.
4. Select an option on the menu (1-4) by typing the number of the option.
Note: Selecting the serial protocol to be Modbus Master will add an additional item to the list.
5. To enter a value for a parameter, type the value and press Enter, or to confirm a default value, press
Enter.
6. Review your entries.
7. You have the following options:
To save the configuration and exit, type S on the command line and press Enter. This saves the
parameters to EEPROM.
Caution: DO NOT POWER CYCLE the unit too fast after doing this. Allow the unit to reboot naturally one
time first.
Selecting Wait for CTS will cause CP3 to be auto-configured for CTS Input. You will not be able to
configure CP3 and the following message will appear:
CP3 Function already configured for CTS Input
Selecting RS485 Output Enable for CP2 will prompt you for additional control options.
Invert RS485 Output Enable(active low) (N)
The RS485 Output Enable function is used for controlling an external RS485 line driver when in RS485
2-wire mode and this output can be configured for active high (default) or active low.
Note: During a Telnet connection, CP1 LED (Status LED) is ON. For a serial port connection, CP1 LED
(Status LED) blinks for 2 seconds, then OFF for 2 seconds. (It appears as 4 blinks, then OFF for 2 seconds)
1) Network/IP Settings:
IP Address . . . . . . . . . . 192.168.100.77
Default Gateway . . . . . . . --- not set ---
Netmask . . . . . . . . . . . --- not set ---
2) Serial & Mode Settings:
Protocol . . . . . . . . . . . Modbus/RTU,Master(s) attached
Serial Interface . . . . . . . 9600,8,N,1,RS232
3) Modem/Configurable Pin Settings:
CP1. . . . .Not Used
CP2. . . . .Not Used
CP3. . . . .Not Used
4) Advanced Modbus Protocol settings:
MB/TCP Exception Codes . . . . Yes (return 00AH and 00BH)
Char, Message Timeout . . . . 00050msec, 05000msec
5) Unit ID -> IP Address Table
Close Idle Sockets . . . . . . 10sec
Redundant Entry Retry . . . . Feature Disabled
Since serial Modbus uses 8-bit slave addresses and a TCP/IP network requires 32-bit IP addresses, the
Device Server uses this table to map an 8-bit address into an IP/Unit ID combination. The 8-bit address is
used to both select the desired IP and as the Unit ID sent. The table holds 8 entries, and any Modbus slave
address not found in the table returns an exception response to the master (if enabled).
Below is an example of adding an entry. Select 5 to edit/view settings.
Close Idle TCP sockets after (3-60 sec, 0=leave open) (10)
Redundant entry retries after (15-60 sec. 0=disable feature) (0)
(Set 4th octet to 0 to use Slave Address as part of IP)
2.13.1 Close Idle TCP sockets after (3-60 sec, 0=leave open)
Sockets are opened as required. Entering a 0 holds a single socket open to the last remote Modbus/TCP
slave accessed.
Otherwise enter values 3 to 60 to automatically close the last socket after 3 to 60 seconds of idle time.
Note: Grid Connect does not endorse WinTECH software. The information is provided to assist software
developers. No support for this software will be provided by Grid Connect.
Baud Byte/Sec Bit Time Byte Time 256 Byte (in sec)
Rate (msec) (msec) Time (msec)
300 30 3.333333 33.333333 8533.333333 8.53
600 60 1.666667 16.666667 4266.666667 4.27
1200 120 0.833333 8.333333 2133.333333 2.13
2400 240 0.416667 4.166667 1066.666667 1.07
4800 480 0.208333 2.083333 533.333333 0.53
9600 960 0.104167 1.041667 266.666667 0.27
19200 1920 0.052083 0.520833 133.333333 0.13
38400 3840 0.026042 0.260417 66.666667 0.07
57600 5760 0.017361 0.173611 44.444444 0.04
115200 11520 0.008681 0.086806 22.222222 0.02
The overall time it takes to poll is the combined sum of these delays:
1. Delay for Master /Client to recognize need for poll
2. Delay to issue and get the poll onto the Ethernet
3. Delay for the poll to cross Ethernet and arrive error-free at the Modbus Bridge device (may include
retries and contention)
4. Delay for Modbus Bridge to process and queue Modbus/RTU poll
5. Delay for the serial link to be free (remember other Masters/Clients may be actively polling)
6. Physical delay to shift poll bit-by-bit across the serial link
7. Delay in the device to recognize, process, and start reply
8. Physical delay to shift response bit-by-bit across the serial link
9. Delay for Modbus Bridge to process and queue Modbus/TCP Response
10. Delay for the response to cross Ethernet and arrive error-free at the Master/Client (may include retries
and contention)
11. Delay for Master /Client to recognize need for poll