Modbus is a serial communication protocol that was published in 1979 by Modicon Corporation (now Schneider Electric) for communication using programmable logic controllers (PLCs). Modbus has become the industry standard for communication protocols in the industrial sector (De facto) and is now a common way to connect industrial electronic devices.

At present, in the process of RS232/RS485 communication, this protocol is widely used.

THERE ARE TWO COMMONLY USED MODBUS COMMUNICATION PROTOCOLS, ONE IS MODBUS ASCII AND THE OTHER IS MODBUS RTU. Generally speaking, the MODBUS ASCII protocol is used for communication with a small amount of communication data and mainly text, and the MODBUS RTU protocol is mostly used for communication data with a large amount of data and binary values.

In practice, in order to solve a particular problem, people like to modify the MODBUS protocol to meet their own needs (in fact, people often use their own defined protocols to communicate, which solves the problem, but is not very standardized). A more common way to use it is to make minor changes to the protocol, but to attach the format of the protocol to the software manual, or directly in the help, so as to facilitate communication with the user.

The ACRXXXE series instruments use the MODBUS-RTU communication protocol, which defines in detail the check codes, data sequences, etc., which are necessary for specific data exchange. The MODBUS protocol uses a master-slave transponder connection (half-duplex) on a single communication line, which means that signals are transmitted in opposite directions on a separate communication line. First, the signal from the master computer is addressed to a unique terminal device (slave), and then the response signal from the terminal device is transmitted to the master in the opposite direction.

The MODBUS protocol only allows communication between the host (PC, PLC, etc.) and the terminal equipment, and does not allow data exchange between independent terminal devices, so that each terminal device does not occupy the communication line when they are initialized, but is limited to responding to the query signal arriving at the machine.

Modbus has the following characteristics:

(1) Standard and open, users can use the Modbus protocol for free and with confidence, without paying license fees and without infringing intellectual property rights. At present, there are more than 400 manufacturers that support Modbus, and more than 600 products that support Modbus.

(2) Modbus can support a variety of electrical interfaces, such as RS-232, RS-485, etc., and can also be transmitted on various media, such as twisted pair, optical fiber, wireless, etc.

(3) The frame format of Modbus is simple, compact, easy to understand, easy for users to use, and simple for manufacturers to develop.

ModbusRTU's function code usage (the following data are in hexadecimal format)

1. Function code 01: read the output status of one or more switching coils

例如：主机要读取地址为01，开关量DO1，DO2的输出状态。For example, the host needs to read the output status of the address 01 and the switch DO1 and DO2.
The address and data of the Slave (PDM) data register are:
从机（PDM）数据寄存器的地址和数据为：

The format of the packet sent by the host：

从机（PDM）响应返回的报文格式：

2、Function code 02: read 1 or more switch status input

For example, the host wants to read the input status of the switch DI1-DI4 with address 01 and switch.

The address and data of the Slave (PDM) data register are:

主机发送的报文格式：

从机（PDM）响应返回的报文格式：

3. Function code 03: read multiplex registers

For example, the master wants to read the register data of three slaves with address 01 and start address 0002.
The address and data of the Slave (PDM) data register are:

主机发送的报文格式：

Format of the packet returned by the slave (PDM) response:

4. Function code 05: write 1 switch output

Example 1: The current state of the switching output point DO1 is "points", and the host needs to control the relay "close".

The control commands are:

"FF00" is the control relay "Close";
"0000" is the control relay "points";
Format of packets sent by the host:

Format of the packet returned by the slave (PDM) response:

The format and data content of the packets sent by the host are identical.

Example 2: The switching output point DO2 has its current state of "Close", and the host wants to control the relay "Divide".

主机发送的报文格式：Format of packets sent by the host:

Format of the packet returned by the slave (PDM) response:

The format and data content of the packets sent by the host are identical.

5. Function code 06: write a single register

For example, if the host wants to save data 1E34 to the slave register with address 000B (the slave device address is 01), this data will overwrite the original storage information in the register address.

Format of packets sent by the host:

Format of the packet returned by the slave (PDM) response:

The format and data content of the packets sent by the host are identical.

6. Function code 10: write multiplex registers

The host uses this function code to save multiple data to the data memory of the PDM table. The registers in the Modbus protocol refer to 16 bits (2 bytes or 1 word) and are preceded by the high bits and followed by the low bits. In this way, the memory of the PDM is 2 bytes. Since the Modbus protocol allows up to 60 registers to be saved at a time, PDM also allows up to 60 data registers to be saved at a time.

For example, the host should save data 2D7A, 42B1, and 15E8 to the slave registers with addresses 002A, 002B, and 002C (the address of the slave device is 01).

Format of packets sent by the host:

Format of the packet returned by the slave (PDM) response:

Attached: ModbusCRC16 verification algorithm