Volume 9 • Issue 5

SEPTEMBER–OCTOBER 2008

© 2008 Contemporary Control Systems, Inc.

Introduction to Modbus Serial and Modbus TCP

By George Thomas, Contemporary Controls

In this second part of a two-part

series on Modbus, we will discuss
two implementations of the Modbus
Protocol that were introduced in our
previous article. The first implemen-
tation is the traditional implementa-
tion of Modbus over a serial line.
The second implementation is more Table 1. Modbus over Serial Line uses a three-layer model.
modern with Modbus operating over instead, the model relies on the subset of all the available function
a TCP/IP network. Both implementa- application layer to ensure end-to- codes. The data structure may
tions remain popular. end delivery of a message. The data change depending upon the function
Modbus over Serial Line link (layer 2) is occupied by the code. Wrapping the Modbus PDU is
Modbus Serial Line Protocol. Finally, an address field and an error check
Modbus.org has released a Modbus the physical layer (layer 1) allows field. The address field only contains
over Serial Line Specification and for either the EIA-232C or EIA-485 slave addresses or the broadcast
Implementation Guide V1.02 that implementation. With only three address. The master address is not
provides guidance when using layers, Modbus over Serial Line is required and not referenced since
Modbus with serial links. As easier to understand than other this is a master/slave protocol with
mentioned in our previous article, industrial protocols. Since the commands originating from a
Modbus was originally intended to Modbus Application Protocol was unique master.
be used with point-to-point EIA-232C discussed in part 1, it will not be
interfaces with the master being a As mentioned in part 1, the actual
repeated here. Instead, only the framing of Modbus over Serial Line
Human Machine Interface (HMI) and data link and physical layers will
a PLC as the slave. Multiple slaves messages depends on whether ASCII
be discussed. or RTU transmission mode is used.
connected to one master would then
require multiple links which is Data Link Layer RTU is the most popular mode and
inconvenient and expensive. It is shown in Figure 2. It is a very
Much about the Modbus over Serial
would be only natural to change the compact frame with only one byte
Line Protocol Data Unit (PDU) was
point-to-point link to a multipoint reserved for the slave or broadcast
mentioned in part 1 but will be
serial infrastructure such as EIA-485 address, one byte for the function
summarized below. Referring to
which would allow one master to code and two bytes for the CRC
Figure 1, note that the PDU consists
communicate to multiple slaves over
a common serial line. This approach
is encouraged in the Modbus.org
document, but not mentioned in the
original Modicon Modbus Protocol
Reference Guide.
Three Layer Model Figure 1. A slave address field and error check wrap around a Modbus PDU.

Instead of the traditional seven-layer error check. A single byte carries the
of four elements. In the middle is
ISO Open Systems Interconnection function code. Notice that there is
the Modbus PDU consisting of a
Reference Model, the Modbus over no end-of-frame sequence. With
function code and data. Most
Serial Line model is collapsed to RTU, end-of-frame is indicated by
Modbus implementations only use a
three layers as shown in Table 1. At 3.5–4.5 character times of silence.
the top is the application layer that
was discussed in part 1. This is
called the Modbus Application
Protocol or simply the Modbus
Protocol. Layers 3–6 are not used —
Figure 2. RTU framing is more condensed than ASCII framing.

(No part of the Extension may be reproduced without the written consent of Contemporary Controls.) 1
 The largest frame occupies only 256 EIA-485 standard — supporting up Line polarization is used to force the
bytes. With RTU each byte is sent to 32 devices over a common bus. bus into a known state when no
using 11 bits. Each data character This can be implemented with either drivers are active. EIA-485 receivers
requires eight bits. There is one start- a two-wire or four-wire cabling require a 200 mv failsafe bias to
bit, one stop-bit and one parity-bit. If configuration. With any of the serial ensure they detect a floating line as
parity is not used, another stop-bit is line implementations, a wide range an “off” state. This is why line
sent in its place. If parity is employed, of baud rates from 1.2 kbps to 115 polarization is typically referred to as
it can be odd or even. kbps are allowed, but all implemen- failsafe bias. At each end of the bus
The ASCII message format in Figure tations must at least support 9.6 kbps are line terminators (LT) to match
3 requires two bytes for the slave and 19.2 kbps. The default rate is the natural impedance of the bus.
address as well as for the function 19.2 kbps. The pull-up and pull-down resistors
interact with the two termination
resistors to create the failsafe bias.
The Modbus over Serial Line
specification recommends that the
pull-up and pull-down resistors have
Figure 3. ASCII framing requires start-of-frame and end-of-frame characters. values between 450 and 650 ohms,
and that only one network is used.
code. Unlike RTU, the ASCII frame Two-Wire Network
uses a two-byte LRC for the error This assumes that failsafe bias is
Figure 4 shows a recommended two- needed at all. Some transceivers
check field. The advantage of the
wire interface for EIA-485 networks have built-in bias so external bias is
ASCII format is that it is human
with applied line polarization. As not needed.
readable. Notice that there is an
expected, there is one master trans-
end-of-frame sequence composed of Four-Wire Network
ceiver and multiple slave transceivers
carriage return and line feed (CR,LF).
connected to a common 2-wire bus Figure 5 shows a recommended
Inter-frame spacing is not critical.
with the wires labeled D1 and D0. four-wire interface still using EIA-485
Data is represented as a hexadecimal
value coded as ASCII. Therefore, At a minimum, a total of 32 devices devices. The transmitter of each
only 7 bits are required for every must be supported. With a 2-wire device is separated from the device’s
ASCII character, but two characters bus, the output of the transmitter is receiver. The master has its transmitter
are required for each byte of data. directly tied to the input of a receiver connected to all the slaves’ receivers
One start-bit and one stop-bit are at each device. Even though this is while all the slaves’ transmitters are
used. If a parity-bit is used, either called a 2-wire bus, there is a connected to the master’s receiver.
odd or even parity can be sent. If no common reference connection Failsafe bias and termination are still
parity is sent, then another stop-bit is labeled common. Each device must used — but their requirements are
sent. This means each byte in ASCII share its common with all other doubled in a four-wire network.
is sent as 10 bits. devices on the bus to ensure that the Even the four-wire arrangement
requires a “fifth” wire and that is the
common.
Although the Modbus over Serial
Line specification supports both a
2-wire and 4-wire arrangement, the
2-wire implementation is the most
popular. Although it is possible to
have a full-duplex link with 4 wires,
the Modbus protocol is strictly half-
duplex. The master imitates
commands to a particular slave while
awaiting the slave’s response. This is
handled quite effectively with a
Figure 4. A two-wire serial line implementation actually requires three wires. 2-wire implementation.

Physical Layer maximum common-mode voltage

The original Modbus protocol called rating of the device is not exceeded.
for a point-to-point EIA-232C link The line polarization network
between a host computer and a PLC. (consisting of a pull-up and pull-
This option remains today. But the down resistor) is shown near the
Modbus over Serial Line specification master, but its location is not a
encourages the use of the multipoint requirement — only a recommendation.

2
 Another significant change (shown in
Figure 6) is that the Modbus bus is
actually an IP bus. The physical and
data link layers are not specified.
Instead of having one master
attached to multiple slaves, the terms
client and server are used. Clients
could be HMIs or PLCs, while servers
could be input/output racks. Like a
master, clients initiate commands to a
server. Like a slave, servers respond
to client commands. However, the
proper terminology with client/server
communications is that clients initiate
requests with servers providing
responses. It is actually a bit more
involved than that.
Figure 5. A four-wire serial line implementation actually requires five wires.
* A Request is sent by the client to
Modbus TCP model was used for Modbus TCP as
initiate a transaction.
shown in Table 2. Instead of a long
The Modbus protocol continues to
discussion on physical and data link * An Indication is sent by the
survive in an automation world server to confirm that a request
layer issues, the standard only needs
more interested with connecting to was received.
to point to the 1500 page IEEE 802.3
Ethernet networks and more
standard. There is no mention of * A Response is sent by the server
specifically, IP/Ethernet networks.
how to physically attach stations or to comply with the client request.
Modbus.org authored the
what cabling or connectors to use.
* A Confirmation is sent by the
client to acknowledge receipt of
the response.
What is significant in this model is
that several clients can reside on the
IP network and access a common set
of servers. This is a fundamental
Table 2. Modbus TCP uses a five-layer Internet model.
change in how the Modbus protocol
works. There is no single master
Modbus Messaging on TCP/IP This messaging standard only talks controlling a defined set of slaves.
Implementation Guide V1.0b for this about how a Modbus PDU
very purpose. Instead of a three-layer (consisting of a function code and
model that was used for Modbus data) is encapsulated into a higher
over Serial Line, a five-layer Internet level protocol.

Figure 6. Instead of using master and slaves, the Modbus TCP model uses clients and servers.

3
 Any number of clients can access Identifier provides the address of a References
any number of servers. Is it possible Modbus Serial Line slave that must
Modbus Application Protocol
to have conflicts with clients making be accessed through a gateway.
Specification V1.1b,
contradictory requests of a particular With Modbus TCP clients and http://www.Modbus-IDA.org,
server? Yes, that is the risk this model servers, station addressing occurs by December 28, 2006
presents with its newly gained flexibility. using IP addresses. However, if a
The MBAP Header Modbus slave is attached to a serial
line, the actual slave address needs Modbus over Serial Line Specification
Figure 7 shows how a new Modbus and Implementation Guide V1.02,
to be specified. The gateway address
TCP/IP Application Data Unit (ADU) http://www.Modbus-IDA.org,
would then be an IP address. In
is formed. The traditional Modbus December 20, 2006
order to send the ADU over TCP, a
PDU of the Modbus over Serial Line
registered TCP port number must be
method is still present. The function
used. Modbus.org registered port
code and data definitions remain Modbus Messaging on TCP/IP
502 for this purpose.
intact. What is appended to this PDU Implementation Guide V1.0b,
http://www.Modbus-IDA.org,
October 24, 2006

Modbus Protocol Reference Guide

Rev. J, http://www.Modbus-IDA.org,
Figure 7. The Modbus Application Protocol header is added to the Modbus PDU. June 1996

Figure 8. The MBAP header is seven bytes long.

is a Modbus Application Protocol Summary

(MBAP) header, details of which are Modbus is popular for its simplicity.
shown in Figure 8. The Transaction Because so many users with Modbus
Identifier is supplied by the client knowledge are in the field and
and used to keep track of specific because a Modbus-IDA association
requests. The server is to send back backs this open standard, it will
the same identifier with its response. continue to remain popular.
The client is allowed to send
multiple requests to a server without
waiting for individual responses.
The Protocol Identifier would allow
support for multiple protocols. For
Modbus the value is zero. The
Length field identifies the length of
all remaining fields including the
Modbus PDU fields. Finally, the Unit

www.ccontrols.com

Past issues of the copyrighted Extension are available. Please

visit our web site www.ccontrols.com. Select Support and click
on Extension Archive.