2025-04-23
In-depth Analysis of the Modbus Protocol
In-depth Analysis of the Modbus Protocol
Modbus is the most widely used serial communication protocol in the field of industrial automation, which was launched by Modicon (now Schneider Electric) in 1979. Its core features are simplicity, openness and ease of implementation, and it has become the "universal language" in the field of industrial control.
I. Core Features of Modbus
1. Basic parameters
- Communication method:
- Master-slave mode: One master device (such as a PLC) can poll multiple slave devices (up to 247).
- Half-duplex: Data can only be sent or received at the same time
- Transmission medium:
- RS-232/RS-485 (Most commonly used)
- TCP/IP (Modbus TCP)
- Optical fiber, wireless, etc. (Converters required)
- Data model
- Four types of registers, unified addressing space (0-65535)
2. Agreement advantages
| Characteristics | Explanation |
| Simple and reliable | The protocol has low overhead and is suitable for resource-constrained devices such as PLCS |
| Cross-platform | Supported by over 500 manufacturers, it has strong hardware compatibility |
| Real-time performance | The typical response time is 10-100ms |
| Easy to debug | It can be directly tested with the serial port assistant |
Ii. Comparison of Agreement Versions
1. Modbus RTU vs ASCII
- Features: Modbus RTU, Modbus ASCII
- Encode binary hexadecimal text
- High efficiency (compact) and low (50% more data volume)
- Verify the CRC-16 LRC
- Compatible with the mainstream old systems in the application industry
2. Modbus TCP
- Encapsulate on the TCP/IP stack (Port 502)
- The CRC check of RTU (dependent on TCP checksum) has been removed.
- Support multiple requests for one message (up to 260 bytes)
Iii. Detailed Explanation of the Data Model
1. Class 4 registers
| Type | Function | Access method | Address range |
| Coil | Read and write Boolean quantities | Bit operation | 00001-09999. |
| Discrete input | Only read Boolean quantities | Bit operation | 10001-19999. |
| Maintain the register | Read and write numerical values | Word operation | 40001-49999. |
| Input register | Read-only value | Word operation | 30001-39999. |
* Note: The actual protocol uses 0-based addresses (such as 40001=0x0000) *
2. Data type mapping
- 16-bit integer: Stored directly
- 32-bit floating-point number: IEEE754 standard (2 registers)
- String: ASCII codes are stored consecutively
Iv. Analysis of the Communication Process
1.Typical request-response
[Main Device Request]
Slave station address | Function code | Starting address | Data length | CRC check
0x01 0x03 0x0000 0x0002 0xC40A
Slave station address | Function code | Starting address | Data length | CRC check
0x01 0x03 0x0000 0x0002 0xC40A
[Response from the device]
Slave station address | Function code | Byte count | Data 1 | Data 2 | CRC check
0x01 0x03 0x04 0x00FF 0xA5B3 0x8F12
Slave station address | Function code | Byte count | Data 1 | Data 2 | CRC check
0x01 0x03 0x04 0x00FF 0xA5B3 0x8F12
2. Key function code
| Code | Name | Function |
| 0x01 | Read the coil | Read multiple switch quantities |
| 0x03 | Read hold register | Read multiple 16-bit values |
| 0x05 | Write a single coil | Set a single switch quantity |
| 0x10 | Write multiple registers | Batch write data |
V. Exception Handling Mechanism
1. Exception response format
Slave station address | Function code +0x80 | Abnormal code | CRC check
0x01 0x83 0x02 0xF1A2
0x01 0x83 0x02 0xF1A2
2. Common exception codes
| Code | Meaning | Solution method |
| 0x01 | Illegal function code | Check the function codes supported by the device |
| 0x02 | Illegal data address | Confirm the register mapping table |
| 0x03 | Illegal data value | Check the write range |
| 0x04 | The slave station equipment malfunctioned | Check the status of the slave station |
Vi. Security Enhancement Plan
1. Modbus Secure
- Add TLS/DTLS encryption (hardware support required)
- Typical equipment: Hirschmann MICE
2. Gateway protection
- Restrict access to Port 502 through the firewall
- Whitelist management of legitimate main site ips
Vii. Application Scenarios
1. Industrial control
- PLC and HMI communication: Polling over 100 registers per second
- DCS system integration: Modbus RTU to Profibus gateway
2. Energy Management
- Electricity meter data acquisition: Standard DL/T645-2007 based on Modbus
- Photovoltaic inverter monitoring: Read the power generation capacity and temperature
3. Building Automation
- Air conditioning unit control: Set the temperature setting value (4x register)
Viii. Recommended Debugging Tools
- Modbus Poll (Master Station Simulation)
- ModScan32 (Slave Station Test)
- Wireshark (Modbus TCP Packet Capture)
- USB to 485 Debugger (Field Test)
Ix. Limitations of the Agreement
- No device discovery mechanism: Manual configuration of the slave station address is required
- Low efficiency for large data volumes: A maximum of 125 registers can be read at a time
- Weak security: Plaintext transmission, vulnerable to man-in-the-middle attacks
X. Future Evolution
- Modbus over TSN: Supports time-sensitive networks
- OPC UA integration: Achieve semantic interoperability through supporting specifications
- MQTT bridging: Cloud Platform access solution
For more knowledge about LED industry, please pay attention to our LIKELIGHT.If you are not sure which LED fixture is best for your project or need help with layout configuration, contact us LIKLEIGHT, we are a professional manufacturer of LED lamps in China;we have engineers and 24 hours customer service for you.Phone:+86-755-23328395, Email :contact@like-light.com,Wechat/WhatsApp:86-132-66666-320.
