In the world of industrial automation, communication between devices is key to keeping operations running smoothly. Among the many communication protocols out there, Modbus is a standout. Developed by Modicon back in the late 1970s, the Modbus protocol has become a go-to standard for connecting different devices like PLCs, sensors, and actuators.
In this easy-to-understand guide, we’ll break down the basics of the Modbus protocol. We’ll cover what it is, how it works, and why it’s so important in industrial settings.
Understanding Modbus
Modbus is like the language that industrial devices speak to each other. It’s a set of rules that governs how devices can talk and share information. Think of it as a way for devices to have a conversation, with one device asking questions (the master) and the others answering (the slaves).

Modbus Data Packet Structure
Modbus data packets adhere to a defined structure comprising various elements such as addresses, function codes, data fields, and error-checking mechanisms. Understanding this structure is essential for interpreting and processing Modbus messages accurately.
The packet typically consists of:
- Slave Address: Identifies the target slave device in the network.
- Function Code: Specifies the operation to be performed on the data.
- Data Fields: Contain the actual data being transmitted or received.
- Error Checking: Includes checksum or CRC values to ensure data integrity during transmission.

The frame format is composed of an Application Data Unit (ADU), which encloses a Protocol Data Unit (PDU):
- ADU = Address + PDU + Error check
- PDU = Function code + Data
Types of Modbus
There are a few flavours of Modbus to know about:

Modbus RTU: This mode utilizes serial communication, typically over RS-485 or RS-232 connections. It transmits data in binary format, with each byte represented by a series of bits. Modbus RTU is known for its simplicity and reliability, making it well-suited for applications where real-time communication and deterministic behaviour are paramount.

Modbus TCP/IP: In contrast, Modbus TCP/IP leverages Ethernet networks for communication, offering higher speeds and greater flexibility. Data packets are encapsulated in TCP/IP packets, enabling seamless integration with existing network infrastructure. Modbus TCP/IP is favoured for its scalability and ease of deployment in modern industrial environments.

Modbus ASCII: An older version that nobody really uses anymore. It’s like writing letters to each other but using weird symbols instead of words.

Modbus Registers Types
In Modbus, data is stored in registers, which are like boxes where devices keep information. There are four primary types of registers, each serving a specific purpose:
- Coils: Coils are binary values used for controlling discrete outputs, such as relays or indicators. They can be read from or written to by the master device.
- Discrete Inputs: These registers represent binary input values, typically from sensors or switches. They are read-only and provide status information to the master device.
- Input Registers: Input registers store 16-bit integer values, serving as read-only inputs for the master device. They are commonly used for sensor data or other measured values.
- Holding Registers: Holding registers are versatile 16-bit registers that can be read from or written to by the master device. They are often used for storing configuration settings, control parameters, or other operational data.
Understanding the differences between these register types is crucial for effective communication and data exchange in Modbus networks.
Modbus Addressing
Every register in Modbus has an address, which is like its home address. Devices use these addresses to find the data they need. Addresses can be a bit confusing because they’re sometimes written in different ways, but they’re just numbers that tell devices where to look for information.

Modbus Function Codes
Function codes are like commands that tell devices what to do with the data in the registers. For example, a function code might tell a device to read data from a register or write new data to it. Common function codes include:
- Read Coil Status (Function Code 01): Requests the status of coils (binary outputs) from a slave device.
- Read Input Status (Function Code 02): Requests the status of discrete inputs from a slave device.
- Read Holding Registers (Function Code 03): Requests the values of holding registers (read/write) from a slave device.
- Write Single Coil (Function Code 05): Writes a single coil (binary output) value to a slave device.
- Write Single Register (Function Code 06): Writes a single holding register (read/write) value to a slave device.

These function codes enable master devices to perform various read and write operations on registers within slave devices, facilitating data exchange and control in Modbus networks.
Error Handling and Exception Codes
In the event of errors or exceptions, Modbus employs specific codes to indicate issues encountered during communication, facilitating troubleshooting and debugging. Common exception codes include:
- Illegal Function (Exception Code 01): Indicates that the requested function code is not supported by the slave device.
- Illegal Data Address (Exception Code 02): Indicates that the requested register address does not exist in the slave device’s memory map.
- Slave Device Failure (Exception Code 04): Indicates a general failure in the slave device, preventing it from executing the requested operation.

These exception codes help diagnose communication issues and streamline the troubleshooting process in Modbus networks, ensuring reliable operation and minimal downtime.
Modbus Error Checking
These error-checking mechanisms help ensure the integrity of Modbus messages during transmission and reception, allowing the receiver to detect any errors or corruption in the data.
Modbus RTU:
- Error Checking: Modbus RTU uses a CRC (Cyclic Redundancy Check) for error detection. The CRC is calculated over the entire message (including the address, function code, data, and CRC field itself). Both the sender and receiver calculate the CRC, and if they match, it indicates that the message was received without errors.
- CRC Calculation: The CRC is calculated using a polynomial division algorithm. The calculated CRC is then appended to the end of the message before transmission.
Modbus TCP/IP:
- Error Checking: Modbus TCP/IP relies on the error-checking mechanisms provided by TCP/IP, such as the TCP checksum. TCP/IP ensures reliable delivery of data packets by performing error detection and correction at the IP and TCP layers. The TCP checksum is calculated over the entire TCP segment (including the TCP header and data).
- Checksum Calculation: The TCP checksum is computed by taking the 16-bit one’s complement of the one’s complement sum of all 16-bit words in the TCP header and data.
Modbus ASCII:
- Error Checking: Modbus ASCII also uses a simple checksum for error detection. In ASCII mode, each byte of data is represented by two ASCII characters. After the data bytes, two ASCII characters representing the checksum are appended. The checksum is typically the two characters that, when taken together, represent a hexadecimal value calculated over the entire message.
- Checksum Calculation: The checksum is calculated over the address, function code, data bytes, and any additional fields (e.g., unit identifier) using a simple arithmetic sum or XOR operation. The resulting checksum is converted to ASCII characters and appended to the message.
Thank you for embarking on this journey through the fundamentals of Modbus communication. We hope this guide has provided valuable insights and equipped you with the knowledge needed to navigate the world of Modbus with confidence and proficiency.
Stay tuned for our next installment, where we delve into practical coding with STM32 microcontrollers, illustrating how to implement Modbus communication in real-world applications. Until then, happy coding!
>>>>>>>>>>>>>>> How to Use printf on STM32 using ITM+SWO line <<<<<<<<<<<<<<<<<<
Leave a comment