764  Modbus Registers and Communication

Interactive visualization of Modbus register types and master-slave communication patterns

animation
modbus
industrial
protocols

764.1 Learning Objectives

By the end of this chapter, you will be able to:

  1. Distinguish between the four Modbus register types (coils, discrete inputs, input registers, holding registers)
  2. Understand Modicon addressing conventions and PDU address translation
  3. Visualize master-slave communication patterns and timing
  4. Interpret request/response sequences for common industrial operations

764.2 Introduction

Modbus organizes device data into four distinct register types, each serving a specific purpose in industrial automation. Understanding these register types and how they map to device memory is essential for configuring PLCs, SCADA systems, and IoT gateways. This chapter provides interactive visualizations of register maps and communication flows.

Think of registers like different types of mailboxes in a factory:

  • Coils (0x): Light switches you can flip ON/OFF (read/write bits)
  • Discrete Inputs (1x): Sensors that tell you if something is true/false (read-only bits)
  • Input Registers (3x): Measurements like temperature readings (read-only 16-bit numbers)
  • Holding Registers (4x): Settings you can change, like speed setpoints (read/write 16-bit numbers)

Each β€œmailbox” has an address so the master knows exactly which data to read or write!

764.3 Register Map Visualization

764.4 Master-Slave Communication

764.5 Slave State Machine

%% fig-alt: State diagram showing Modbus slave device states for request processing
%%{init: {'theme': 'base', 'themeVariables': {'primaryColor': '#2C3E50', 'primaryTextColor': '#fff', 'primaryBorderColor': '#16A085', 'lineColor': '#E67E22'}}}%%
stateDiagram-v2
    [*] --> Idle: Power On

    Idle --> ReceivingFrame: Frame Start Detected
    ReceivingFrame --> ValidatingFrame: Complete Frame

    ValidatingFrame --> CheckAddress: Checksum Valid
    ValidatingFrame --> Idle: CRC/LRC Error

    CheckAddress --> ProcessingRequest: Address Match
    CheckAddress --> Idle: Not My Address

    ProcessingRequest --> ValidatingFC: Check Function Code
    ValidatingFC --> ValidatingAddress: FC Supported
    ValidatingFC --> ExceptionResponse: Illegal Function (01)

    ValidatingAddress --> ValidatingData: Address Valid
    ValidatingAddress --> ExceptionResponse: Illegal Address (02)

    ValidatingData --> ExecutingCommand: Data Valid
    ValidatingData --> ExceptionResponse: Illegal Value (03)

    ExecutingCommand --> BuildingResponse: Success
    ExecutingCommand --> ExceptionResponse: Device Failure (04)

    BuildingResponse --> Transmitting: Response Ready
    ExceptionResponse --> Transmitting: Exception Ready

    Transmitting --> Idle: Response Sent

    note right of ProcessingRequest
        T1.5 inter-character
        timeout enforced
    end note

    note left of Transmitting
        T3.5 inter-frame
        delay before response
    end note

764.6 RTU Communication Sequence

%% fig-alt: Sequence diagram showing Modbus RTU master-slave communication with timing constraints
%%{init: {'theme': 'base', 'themeVariables': {'primaryColor': '#2C3E50', 'primaryTextColor': '#fff', 'primaryBorderColor': '#16A085', 'lineColor': '#E67E22'}}}%%
sequenceDiagram
    participant M as Master<br/>PLC/SCADA
    participant B as RS-485 Bus
    participant S1 as Slave #1<br/>Sensor
    participant S2 as Slave #2<br/>VFD

    Note over M,S2: Read Temperature from Slave #1

    M->>B: [Addr:01][FC:04][Addr:0000][Qty:0001][CRC]
    Note over M: Wait T3.5 before response expected
    B->>S1: Frame received
    S1->>S1: Process: Read Input Register 0
    S1->>B: [Addr:01][FC:04][Bytes:02][Data:0100][CRC]
    B->>M: Response = 256 (25.6C)

    Note over M,S2: Write Speed Setpoint to Slave #2

    M->>B: [Addr:02][FC:06][Addr:0001][Value:0BB8][CRC]
    B->>S2: Frame received
    S2->>S2: Write 3000 to Holding Register 1
    S2->>B: [Addr:02][FC:06][Addr:0001][Value:0BB8][CRC]
    B->>M: Echo confirms write success

    Note over M,S2: Exception Response Example

    M->>B: [Addr:01][FC:03][Addr:FFFF][Qty:0001][CRC]
    B->>S1: Frame received
    S1->>S1: Invalid address FFFF!
    S1->>B: [Addr:01][FC:83][ExCode:02][CRC]
    B->>M: Exception: Illegal Data Address

    Note over M,S2: Broadcast (No Response)

    M->>B: [Addr:00][FC:06][Addr:0000][Value:0000][CRC]
    B->>S1: Process broadcast
    B->>S2: Process broadcast
    Note over S1,S2: All slaves execute, none respond

764.7 Addressing Conventions

NoteAddress Offset

The Modicon addressing convention uses 1-based addresses (e.g., 40001), while the Modbus PDU uses 0-based addresses (e.g., 0x0000). Always subtract 1 when converting Modicon addresses to PDU addresses:

  • Modicon 40001 = PDU 0x0000
  • Modicon 40100 = PDU 0x0063 (99 in decimal)

764.8 Knowledge Check

NoteQuick Quiz: Register Types

Question: Which register type would you use to read a temperature sensor value in an industrial system?

  1. Coils (0x)
  2. Discrete Inputs (1x)
  3. Input Registers (3x)
  4. Holding Registers (4x)

c) Input Registers (3x) - Input registers are 16-bit read-only registers used for analog input values from sensors. Temperature readings are typically stored as 16-bit values with a scaling factor (e.g., 256 = 25.6 degrees C).

764.9 Summary

  • Four register types: Coils (bits, R/W), Discrete Inputs (bits, R), Input Registers (16-bit, R), Holding Registers (16-bit, R/W)
  • Master-slave architecture: Master initiates all communication; slaves only respond when addressed
  • Broadcast address 0: All slaves process the command but none respond
  • Modicon addressing: Uses 1-based addresses with prefix (40001); PDU uses 0-based (0x0000)
  • Turnaround timing: RTU requires 3.5 character times between frames

764.10 What’s Next

Continue exploring Modbus with these related topics: