ENDA MODBUS PROTOCOL 1. INTRODUCTION Modbus protocol is processor/server architectural based on an industrial contact protocol.This standard ,the first time by the Medicon Company have been developed. Modbus protocol of field devices and the Rs485 standard using data provides the deployment of.(PI-MBUS-300 Rev .J) For detailed information; Modicon Protocol reference guide referable(PI-MBUS-300 Rev.J).Enda Company’s modbus protocol’s supporting the contact specifications on the table below was given. Interface Standard

RS-485

Contact System

Semi Double

Synchronisation System

Start Stop Synchronisation

Data Length

8 Bit

Parity

NONE

The Error Control System

CRC

Baud Rate

1200,2400,4800,9600,19200 bps

Possible involvement of the maximum equipment unit. Maximum Line Length

128

(Master) A B COM.

(Slave) A B COM.

1200 m

(Slave) A B COM.

(Slave) A B COM.

120 Ohm

120 Ohm

As a mere formality link as above-mentioned the configuration will be used. Star or tree as saying that links,data loses caused by because of the will be possible recommended not. Maximum cable length,according to baud rate ,cable properties (capacity,characteristic,impedance etc.) and on the line number of device changes.For example 9600 baud rate

and AWG26 cable used maximum length 1000m should be. At the beginning of line and the end of 120 ohm termination resistance will be used.

2. MODBUS PROTOCOL 2.1 General Definition Modbus protocol, while the sent and receive information Master/Slave method uses.A modbus a network is Master the device and maximum 247 Slave by device be.A permanent Slave from the Master on the listening messages should be kept. A permanent incoming messages to listen and address information to check.If the address of one’s own,to send the answer to incoming message. A message is used for the following frame as the 4 bloc’s sent running consists of.

Device Address

Function Code

Data

Error Control

Modbus Message 1/9

MODBUS-E-01

As the first address information with the message,which to slave defined sent.After the more funtion’s which will be introduced are defined. And in the end,data in a message right were not sent to control the CRC or LRC code sent. The answering slave,in the same answer formats give. By Master Sent To The Message Of Interrogation Device Address

Device Address

Function Code

Function Code

Interrogation Data

Answer Data

Error Control (LRC or CRC)

Error Control (LRC or CRC)

By Slave Sent To The Answer Message

2.2 Modbus Message Framing ASCII Framing On the Ascii framing messages starts with the two point (:) character and (CR-LF) with the Ascii characters are completed. (Provisions Hex 0x0xD and 0x0A)

BEGINNING 1 CHARACTER

ADDRESS

FUNCTION

2 CHARACTER

2 CHARACTER

DATA N CHARACTER

LRC CONTROL 2 CHARACTER

FINAL 2 CHARACTER [CRLF]

RTU Framing On the RTU framing messages, at least 3.5 character until the time of housed a blank is started. More than the respectively; Address,Function, Data and with the CRC Control finish.More often than fast because of the RTU framing used.Data transferring to the following are seen as being such as.

BEGINNING

T1-T2-T3-T4

ADDRESS

FUNCTION

8 BIT

8 BIT

DATA

N * 8 BIT

CRC CONTROL

16 BIT

FINAL T1-T2-T3-T4

Adres Section : In this section the data which will include the slave’s address are defined. Valid slave address numbers are among the 1-247.Master the area which to slave information will send it’s name writer.The answer to the slave,the same section it own address write and answer.This can master, from the right address that is was information understand. . Function Section : Valid function codes are among the 1-255. From the master to slave a message function was sent to to the code that the device in which types of processing of the relevant will.Answer managed(slave) to function code division at sight,in accordance with slave’s answer did not give a clear. Managed (slave) by If any inanppropriate because of the situation if will sent to the error code,function code’s the most valuable bit to make logic 1 and return. In this case,how is Master the error of the moments were formed.From the error codes,particularly are going to be talked in future. Data Section : Data in the department of information,function code and function defined in the according to data which should be the use of the data.Data section of the 1-244 length of the byte possible. .

2/9

MODBUS-E-01

Error Control Section : On the ASCII and RTU framings,two different the error control method of the used. On the RTU framing CRC control method of used.On the ASCII framing LRC method of used.But the Enda provide only modbus RTU control applies for there is only CRC control system is going to be talked.

.

CRC Control On the RTU mode sent and received all in the message CRC code must be found.The purpose of the It,the information’s on the line integrity breakdown understanding that it was.All the frame using data CRC-16 according to the algorithm 2 byte length CRC code is established.From the algorithm details are not going to be talk about in this place.

2.3 Modbus Data Model MODBUS data model four groups is devided.Different functions of different for data groups allocated. . Data Type

Object Type

Access Form

Address Range

Discretes Input

1 bit

Only Readable

0 FFFFh

Coils

1 bit

Readable and Writable

0 FFFFh

Input Registers

16-bit word

Only Readable

0 FFFFh

Holding Registers

16-bit word

Readable and Writable

0 FFFFh

As modbus network is based on equipment be read for writing a certain memory areas need to be allocated. Data types of different according tý the 4 different memory region need to be allocated.On the modbus protocol 4 different data format used.Address bands at the same but the physical as the flash memory areas are different. Every function with itself memory . memory of the region the data writes or reads.

Coils Coils with 1 bit can be represented the system variable improvement or watch provides.A for example relays open or closed event, a functions active and the lack of as.0-FFFFh address in the region of addressing,it is possible. .

Discretes Input Digital inputs occur at ON/OFF to become the sites in order to read used.This memory only in the area of reading can be made.For Example a PLC in the digital inputs occur what is in a position that there is in order to read can be used. Address area is among the 0-FFFFh.

Input Registers This memory area provide analog inputs in order to read or provide information collection can be used to.The register This registers 16 bit length only the data in order to read are used. Address area is among the 0-FFFFh.

Holding Registers This memory area field from the device if any exits of any values an information dispatch can be used to. Address area is among the 0-FFFFh. EUC442 UNIVERSAL CONTROLLER for maximum data numbers: Function Code (01)h

Message’s Maximum A Within The Message Length(Byte) Masimum Number Of Data 16 bit 8 Byte

Meaning Read the coils

(02)h

Read the discrete inputs

(03)h

Read the holding registers

33 Word

72 Byte

(04)h

Read the input registers

1 Word

8 Byte

1 Word

8 Byte

16 bit

8 Byte

(06)h (0F)h (10)h

Read the single holding register Write to the coils Write to the holding registers 3/9

16 bit

33 Word

8 Byte

72 Byte MODBUS-E-01

2.4 Modbus Function Codes and Descriptions 2.4.1 Read Coil Status (01h) This function code is addresses the bit level control and exit to read used . If 8 bit’s layers least in the remaining for bits set to “0”. . Function Code

A Message Readable Maximum Number Of Bits.

(01)h

2000 (07D0h)

Modbus Address Range 0 - FFFFh

2.4.2 Read Discrete Inputs (02h) In this function code is 0000 and FFFFh addresses among the bit level control and exit in order to read used. Message’s structure is at real coil status function as follows. . Function Code

A Message Readable Maximum Number Of Bits.

(02)h

2000 (07D0h)

Modbus Address Range 0 - FFFFh

Message’s Structure: Instruction Message’s Structure (On the byte format)

Answer Message’s Structure (On the byte format)

Device Address

Device Address

Function Code

Function Code MSB

For reading coils beginning address

For reading number of coil (N)

Total Byte Number ( INTEGER{(N+7)/8})

LSB

First the 8 bit’s location

MSB

Following the 8 bit’s location

LSB LSB

The last 8 bit’s location

CRC DATA MSB

LSB CRC DATA MSB

Sent to the data’s structure First the 8 bit’s location

Starting Address(+7) the following coil’s information

Starting Address the following coil’s information Starting Address(+8) the following coil’s information

Following the 8 bit’s location

The last 8 bit’s location

An Example Of Message : There are (00000) address the coil’s information be in demand. Instruction Message’s Structure (On the byte format)

Answer Message’s Structure (On the byte format)

Device Address

(01)h

Device Address

(01)h

Function Code

(01)h

Function Code

(01)h

For reading coils beginning address

For reading number of coil (N)

MSB

(00)h

LSB

(00)h

MSB

(00)h

(01)h

Byte Number First the 8 bit’s location

(00)h

LSB

(51)h

MSB

(88)h

CRC DATA LSB

(01)h

LSB

(FD)h

MSB

(CA)h

CRC DATA

The Meaning Of Received Data (0)

(0)

(0)

(0)

(0)

(0)

(0)

(0)

1 numbered the coil’s value =0

4/9

MODBUS-E-01

2.4.3 Read Holding Registers (03h) Starting address and quantity that holding register’s in succession reading provides.The incoming datas before the weighted the low after the valuable as a byte comes. . A Message Readable Maximum Number Of Words.

Function Code (03)h

Modbus Address Range 0 - FFFFh

125 (7D0h) Word

Message’s Structure: Instruction Message’s Structure (On the byte format)

Answer Message’s Structure (On the byte format) Device Address

Device Address

Function Code

Function Code

For reading coils beginning address

For Reading Total Byte Number

MSB LSB MSB

For reading number of register (N)

1 125

LSB LSB

CRC DATA

To the desired the first data’s content (16 Bit)

MSB

To the desired the second data’s content (16 Bit)

MSB

To the desired the latest data’s content (16 Bit)

MSB

LSB

LSB

MSB

LSB LSB

CRC DATA MSB

An Example Of Message : The following message for example (02)h address of the from device (0015)h the relative address by starting 2 units of holding register reading.This addresses temperature set value of the maximum and minimum values reading. Answer Message’s Structure (On the byte format)

Instruction Message’s Structure (On the byte format)

(02)h

Device Address

(02)h

(03)h

Function Code

(03)h

MSB

(00)h

Byte Number

(04)h

LSB

(18)h

MSB

(00)h

LSB

(02)h

LSB

(XX)h

MSB

(XX)h

Device Address Function Code

For reading register’s beginning address

For reading number of register

For reading the first holding register’s content

MSB

(02)h

LSB

(58)h

For reading the second holding register’s content

MSB

(0)h

LSB

(0)h

LSB

(49)h

MSB

(58)h

CRC DATA CRC DATA

The Meaning Of Received Data:

Temperature set value ot he maximum value : (0258)h = (600) Temperature set value of the minimum value : (0000)h = (0)

5/9

MODBUS-E-01

2.4.4 Read Input Registers (04h) Starting address and quantity that input register’s in succession reading provides. The incoming datas before the . weighted the low after the valuable as a byte comes. A Message Readable Maximum Number Of Words.

Function Code (04)h

Modbus Address Range 0 - FFFFh

125 (7D0h) Word

Message’s Structure: Answer Message’s Structure (On the byte format)

Instruction Message’s Structure (On the byte format) Device Address

Device Address

Function Code

Function Code

For reading register’s beginning address

MSB

For Reading Total Byte Number

LSB MSB For reading number of register (N)

1 125

LSB LSB

To the desired the first data’s content (16 Bit)

MSB

To the desired the second data’s content (16 Bit)

MSB

To the desired the latest data’s content (16 Bit)

MSB

LSB

LSB

CRC DATA MSB

LSB LSB

CRC DATA MSB

An Example Of Message : The following message from for example in the field of the (05)h address the device’s (0000)h address by starting a 1 units of Input Register reading.Address to the table were taken, care of this address as measured by the value of temperature can be seen as. Answer Message’s Structure (On the byte format)

Instruction Message’s Structure (On the byte format) Device Address

(05)h

Device Address

(05)h

Function Code

(04)h

Function Code

(04)h

MSB

(00)h

Byte Number

(02)h

LSB

(00)h

MSB

(00)h

LSB

(01)h

For reading register’s beginning address

For reading number of register

For reading the first input register’s content

MSB

(00)h

LSB

(55)h

LSB

(88)h

MSB

(CF)h

CRC DATA LSB

(XX)h

MSB

(XX)h

CRC DATA

The Meaning Of Received Data:

Measured Temperature Value : (0055)h = (85)

6/9

MODBUS-E-01

2.4.5 Write Single Register (06h) A single holding register’s adding that it address provides reading. .The incoming datas before the weighted (MSB) the .low (LSB) after the valuable as a byte comes. . A Message Writable Maximum Number Of Words. 1Word

Function Code (06)h

Modbus Address Range 0 - FFFFh

Message’s Structure: Instruction Message’s Structure (On the byte format)

Answer Message’s Structure (On the byte format)

Device Address

Device Address

Function Code

Function Code

For writing register’s beginning address

For writing data’s Content

(16 Bit)

MSB

MSB

The Written Register’s Beginning Address

LSB MSB

LSB MSB

For writing data’s Content (N)

LSB

LSB

LSB

LSB

CRC DATA

CRC DATA MSB

MSB

An Example Of Message : The following message from for example in the field of the (06)h address the device’s (0002)h address by starting a 1 units of Holding Register reading.Address to the table when to looked at,of this address alarm 2 hysteresis parameter’s can see that. Answer Message’s Structure (On the byte format)

Instruction Message’s Structure (On the byte format)

Device Address

(06)h

Function Code

(06)h

For writing register’s beginning address

For writing data’s Content

(16 Bit)

MSB

(00)h

LSB

(02)h

MSB

(00)h

LSB

(11)h

LSB

(E9)h

(06)h

Device Address

(06)h

Function Code The Written Register’s Beginning Address

For writing data’s Content

(16 Bit)

MSB

(00)h

LSB

(02)h

MSB

(00)h

LSB

(11)h

LSB

(E9)h

MSB

(B1)h

CRC DATA

CRC DATA MSB

(B1)h

The Meaning Of Sent Data: Alarm2 hysteresis parameter (11)h = 17 to make.

7/9

MODBUS-E-01

2.4.6 Write Multiple Coils (0Fh) The starting address and some amount that it coil’s On or Off to be held to ensure. If it will be set coil’s number 8’s from layers least, for the rest bits OFF so sent to .the “0”. A Message Writable Maximum Number Of Coil.

Function Code (0F)h

Modbus Address Range 0 - FFFFh

7B0h bit

Message’s Structure: Answer Message’s Structure (On the byte format)

Instruction Message’s Structure (On the byte format) Device Address

Device Address

Function Code

Function Code

MSB

For writing register’s beginning address

MSB

For writing coils beginning address

LSB

LSB

MSB

MSB

For Writing Number Of Coil (N)

For Writing Number Of Coil (N)

LSB

LSB LSB

Total Byte Number ( INTEGER{(N+7)/8})

CRC DATA MSB

First he 8 bit’s information Following the 8 bit’s information

The last 8 bit’s information

LSB

CRC DATA MSB

Sent to the data’s structure Starting Address(+7) the following coil’s data

Starting Address the following coil’s data

First the 8 bit’s data

Starting Address(+8) the following coil’s data

Following the 8 bit’s data

The last 8 bit’s data

An Example Of Message : Answer Message’s Structure (On the byte format)

Instruction Message’s Structure (On the byte format) Device Address

(01)h

Device Address

(01)h

Function Code

(0F)h

Function Code

(0F)h

For writing coils beginning address

For writing number of coil (N)

MSB

(00)h

LSB

(04)h

MSB

(00)h

LSB

Total Byte Number

For writing coils beginning address

For writing number of coil (N)

(02)h (01)h

MSB

(00)h

LSB

(04)h

MSB

(00)h

LSB

(02)h

LSB

(95)h

MSB

(CB)h

CRC DATA First the 8 bit’s linformation

(03)h

LSB

(AE)h

MSB

(96)h

CRC DATA

The Meaning Of Sent To Data:

(0)

(0)

(0005) address of the coil logic 1 to make.

(0)

(0)

(0)

(0)

(1)

(1)

(0004) address of the coil logic 1 to make.

8/9

MODBUS-E-01

2.4.7 Write Multiple Holding Registers (10h) Starting address and quantity that to holding registers in succession data in order to write used.Data sent to the . most before weighted byte (MSB),after the valuable low as byte should be sent. A Message Writable Maximum Number Of Word.

Function Code (10)h

Modbus Address Range 0 - FFFFh

123 (7Bh) word

Message’s Structure: Answer Message’s Structure (On the byte format)

Instruction Message’s Structure (On the byte format)

Device Address

Device Address

Function Code

Function Code

MSB

For writing register’s beginning address

MSB

For writing register’s beginning address

LSB

LSB

MSB

For Writing Number Of Coil (N)

1

123

MSB

For writing number of register (N)

LSB

LSB

N*2

Byte Number

LSB

CRC DATA

MSB

MSB

For writing first data’s content

(16 Bit)

LSB

For writing second data’s content (16 Bit)

MSB

For writing last data’s content (16 Bit)

MSB

LSB

LSB LSB

CRC DATA

MSB

An Example Of Message : Instruction Message’s Structure (On the byte format)

Answer Message’s Structure (On the byte format)

Device Address

(02)h

Device Address

(02)h

Function Code

(10)h

Function Code

(10)h

For writing register’s beginning address

For writing number of register

MSB

(00)h

LSB

(16)h

MSB

(00)h

LSB

(02)h

Byte Number For writing first data’s content (16 Bit) For writing second data’s content (16 Bit)

For writing register’s beginning address

For writing number of register

(04)h

MSB

(00)h

LSB

(16)h

MSB

(00)h

LSB

(02)h

LSB

(XX)h

MSB

(XX)h

CRC DATA MSB

(00)h

LSB

(7E)h

MSB

(01)h

LSB

(26)h

LSB

(XX)h

MSB

(XX)h

CRC DATA

The Meaning Of Sent To Data:

On the(0016)h address situated Ti_Parameter = (0x7E) = 12.6 minute to make. On the (0017)h address situated Td_Parameter = (0x126) = 2.94 minute to make.

9/9

MODBUS-E-01