Editing Modbus (section)

== Modbus over Serial Line protocol ==
Modbus standard also defines Modbus over Serial Line, a protocol over the [[data link layer]] of the OSI model for the Modbus application layer protocol to be communicated over a [[Serial communication|serial bus]].{{Sfn|MODBUS over Serial Line protocol|2006|p=4|ps=}} Modbus Serial Line protocol is a [[master-slave protocol]] which supports one master and multiple slaves in the serial bus.{{Sfn|MODBUS over Serial Line protocol|2006|p=5|ps=}} With Modbus protocol on the application layer, client/server model is used for the devices on the communication channel. With Modbus over Serial Line, ''client''{{'s}} role is implemented by ''master'', and the ''server''{{'s}} role is implemented by ''slave''.{{Sfn|MODBUS over Serial Line protocol|2006|p=5|ps=}}<ref name="x5" />

The organization's naming convention inverts the common usage of having multiple clients and only one server. To avoid this confusion, the RS-485 transport layer uses the terms "node" or "device" instead of "server", and the "client" is not a "node".<ref name="x5" />

{{block quote |The (Modbus Organization) is using "client-server" to describe Modbus communications, characterized by communication between [client device (s), which initiates communication and makes requests of server device(s), which process requests and return an appropriate response (or error message).}}

A serial bus for Modbus over Serial Line can have a maximum of 247 slaves communicating with one master. Those slaves have a unique address ranging from 1 to 247 (decimal value).{{Sfn|MODBUS over Serial Line protocol|2006|p=8|ps=}} The master doesn't need to have an address.{{Sfn|MODBUS over Serial Line protocol|2006|p=8|ps=}} The communication process is initiated by the master, as only it can initiate a Modbus transaction. A slave will never transmit any data or perform any action without a request from the master, and slaves cannot communicate with each other.{{Sfn|MODBUS over Serial Line protocol|2006|p=7|ps=}}

In Modbus over Serial Line, the master initiates requests to the slaves in ''unicast'' or ''broadcast'' modes. In ''unicast mode'', the master will initiate a request to a single slave with a specific address. Upon receiving and finishing the request, the slave will respond with a message to the master.{{Sfn|MODBUS over Serial Line protocol|2006|p=8|ps=}} In this mode, a Modbus transaction includes two messages: one request from the master and one reply from the slave. Each slave must have a unique address (from 1 to 247) to be addressed independently for the communication.{{Sfn|MODBUS over Serial Line protocol|2006|p=8|ps=}} In ''broadcast mode'', the master can send a request to all the slaves, using the broadcast address 0,{{Sfn|MODBUS over Serial Line protocol|2006|p=8|ps=}} which is the address reserved for broadcast exchanges (and not the master address). Slaves must accept broadcast exchanges but must not respond.{{Sfn|MODBUS over Serial Line protocol|2006|p=7|ps=}}
The mapping of PDU of Modbus to the serial bus of Modbus over Serial Line protocol results in Modbus Serial Line PDU.{{Sfn|MODBUS over Serial Line protocol|2006|p=8|ps=}}

Modbus Serial Line PDU = Address + PDU + CRC (or LRC)

With PDU  = Function code + data

* Address is slave address
* PDU is defined identically to the PDU of Modbus Application protocol
* The Error check field with CRC/LRC: The error check methods depend on the protocol versions of the MODBUS over Serial Line, whether it is ''Modbus RTU'' or ''Modbus ASCII''.

On the [[physical layer]], MODBUS over Serial Line performs its communication on bit by [[RS485]] or [[RS-232|RS232]], with TIA/EIA-485 Two-Wire interface as the most popular way. RS485 Four-Wire interface is also used. TIA/EIA-232-E (RS232) can also be used but is limited to point-to-point short-range communication.{{Sfn|MODBUS over Serial Line protocol|2006|p=5|ps=}} MODBUS over Serial Line has two transmission modes ''RTU'' and ''ASCII'' which are corresponded to two versions of the protocol, known as ''Modbus RTU'' and ''Modbus ASCII''.{{Sfn|MODBUS over Serial Line protocol|2006|p=12|ps=}}

=== Modbus RTU ===
Modbus RTU (Remote Terminal Unit), which is the most common implementation available for Modbus, makes use of a compact, binary representation of the data for protocol communication. The RTU format follows the commands/data with a [[cyclic redundancy check]] checksum as an error check mechanism to ensure the reliability of data. A Modbus RTU message must be transmitted continuously without inter-character hesitations. Modbus messages are framed (separated) by idle (silent) periods. Each byte (8 bits) of data is sent as 11 bits:<ref name="Drury2009" />{{Sfn|MODBUS over Serial Line protocol|2006|p=12|ps=}}

* 1 start bit
* 8 bit data/message, least significant bit sent first
* 1 bit parity
* 1 stop bit

The default is even parity, while odd or no parity may be implemented as additional options.{{Sfn|MODBUS over Serial Line protocol|2006|p=12|ps=}}

A Modbus RTU frame then will be:{{Sfn|MODBUS over Serial Line protocol|2006|p=13|ps=, "2.5.1.1 MODBUS Message RTU Framing"}}
{| class="wikitable" style="float:middle; margin:0 0 1em 1em;"
!Slave address
!Function Code
!Data
!CRC
|-
|1 byte
|1 byte
|0 – 252 bytes
|2 bytes: 1 CRC low byte and 1 CRC high byte
|}
The CRC calculation is widely known as CRC-16-MODBUS, whose polynomial is ''x''<sup>16</sup> + ''x''<sup>15</sup> + ''x''<sup>2</sup> + 1 (normal hexadecimal algebraic polynomial being <code>8005</code> and reversed <code>A001</code>).{{Sfn|MODBUS over Serial Line protocol|2006|p=39|ps=}}

Example of a Modbus RTU frame in hexadecimal: <code>01 04 02 FF FF B8 80</code> (CRC-16-MODBUS calculation for the 5 bytes from <code>01</code> to <code>FF</code> gives <code>80B8</code>, which is transmitted least significant byte first).

To ensure frame integrity during the transmission, the time interval between two frames must be at least the transmission time of 3.5 characters, and the time interval between two consecutive characters must be no more than the transmission time of 1.5 characters.{{Sfn|MODBUS over Serial Line protocol|2006|p=13|ps=, "2.5.1.1 MODBUS Message RTU Framing"}} For example, with the default data rate of 19200 bit/s, the transmission times of 3.5 (t3.5) and 1.5 (t1.5) 11-bit characters are:

<math>t3.5 = 3.5*\left( \frac{11*1000}{19200} \right)= 2.005 ms</math>

<math>t1.5 = 1.5*\left( \frac{11*10^6}{19200} \right)= 859.375 \mu s</math>

For higher data rates, Modbus RTU recommends to use the fixed values 750&nbsp;μs for t1.5 and 1.750 ms for t3.5.{{Sfn|MODBUS over Serial Line protocol|2006|p=13|ps=, "2.5.1.1 MODBUS Message RTU Framing"}}

=== Modbus ASCII ===
Modbus ASCII makes use of [[ASCII]] characters for protocol communication. The ASCII format uses a [[longitudinal redundancy check]] checksum. Modbus ASCII messages are framed by a leading colon (":") and trailing newline (CR/LF).

A Modbus ASCII frame includes:{{Sfn|MODBUS over Serial Line protocol|2006|p=17|ps=, "2.5.2.1 MODBUS Message ASCII Framing"}}
{| class="wikitable" style="float:middle; margin:0 0 1em 1em;"
|-
! Name
! Length (bytes)
! Function
|-
! Start
| 1
| Colon <code>:</code> ([[ASCII]] value 3A<sub>16</sub>)
|-
! Address
| 2
| Station address
|-
! Function
| 2
| Indicates the function code e.g. "read coils"
|-
! Data
|''n'' × 2
| Data + length will be filled depending on the message type
|-
! LRC
| 2
|[[Checksum]] ([[longitudinal redundancy check]])
|-
! End
| 2
| Carriage return + line feed (CR/LF) pair (ASCII values 0D<sub>16</sub> and 0A<sub>16</sub>)
|}
Address, Function, Data, and LRC are ASCII hexadecimal encoded values, whereby 8-bit values (0–255) are encoded as two human-readable ASCII characters from the ranges 0–9 and A–F. For example, a value of 122 (7A<sub>16</sub>) is encoded as two ASCII characters, "7" and "A", and transmitted as two bytes, <code>55</code> (37<sub>16</sub>, ASCII value for "7") and <code>65</code> (41<sub>16</sub>, ASCII value for "A").

LRC is calculated as the sum of 8-bit values (excluding the start and end characters), negated ([[two's complement]]) and encoded as an 8-bit value. For example, if Address, Function, and Data are 247, 3, 19, 137, 0, and 10, the two's complement of their sum (416) is −416; this trimmed to 8&nbsp;bits is 96 (256 × 2 − 416 = 60<sub>16</sub>), giving the following 17 ASCII character frame: <code>:F7031389000A60␍␊</code>. LRC is specified for use only as a checksum: because it is calculated on the encoded data rather than the transmitted characters, its 'longitudinal' characteristic is not available for use with parity bits to locate single-bit errors.