Brief introduction

Modbus protocol was originally developed by Modicon company. At the end of

1979, the company became a part of Schneider automation department. Now
MODBUS is the most popular protocol in the world in the industrial field.This
protocol supports traditional RS-232, RS-485 and Ethernet devices.

In MODBUS network, there can be 2 ~ 248 devices, i.e. 1 master device and
247 slave devices (at most).Each slave device is assigned an address in the
range of 1 to 247.Modbus communication is always initiated by the master device,
and the slave device will never send data when it does not receive a request from
the master device.Slave devices never communicate with each other.The master
device can only initiate one MODBUS transaction at the same time.

The master device addresses the slave device by putting the address of the
slave device into the address field of the message.When the slave device returns
the reply, it puts its own address into the address field of the reply message to let
the master device know which slave device is answering.

This manual is used to communicate with Aowei mass flowmeter transmitter

through MODBUS;This paper mainly expounds the communication between the
transmitter and the upper system.This communication is based on pi-mbus-300,
RevStandard Modbus Protocol (RTU mode) defined by B.

Communication parameters
Transmission mode: RTU mode
Baud rate: 9600 (default) (modifiable)
Check bit: no check (default) (modifiable)
Start bit: 1
Data bits: 8
Stop bit: 1 (default) (modifiable)
TX / RX mode: half duplex supports RTS, CTS, DTR, DSR and DCD
Steering time: > = 150ms

Communication process
Modbus protocol defines the message structure that a controller can
recognize, no matter what network they communicate through.It describes the
process of the controller requesting access to other devices, how to respond to
requests from other devices, and how to detect and record errors.It establishes the
common format of message domain pattern and content.
 Using RTU mode, message sending should start with a pause interval of at
least 3.5 characters.Under the character time of various network baud rates, this is
the easiest to achieve (as shown in t1-t2-t3-t4 in the following table).The address of
the first transport device is.The transmission characters that can be used are
hexadecimal 0... 9, a... F.Network equipment continuously detects the network bus,
including the pause interval.When the first domain (address domain) is received,
each device decodes to determine whether it is sent to its own.After the last
transmitted character, a pause of at least 3.5 characters marks the end of the
message.A new message can start after this pause.
The entire message frame must be transmitted as a continuous stream.If
there is a pause time of more than 3.5 characters before the frame is completed,
the receiving device will refresh the incomplete message and assume that the next
byte is the address field of a new message.Similarly, if a new message starts with
the previous message within less than 3.5 characters, the receiving device will
consider it a continuation of the previous message.This will cause an error because
the value in the last CRC field cannot be correct.Typical message frames are as
follows:

start Device Function data CRC end

address code check
T1T2T3T4 8 bits 8 bits n*8 bits 16 bits T1T2T3T4

start:
3.5Interval of characters
Address field:
The address field of the message frame contains 8bits
(RTU).Possible slave addresses are 0 to 247 (decimal).The address
range of a single device is 1 ~ 247.The master device selects the slave
device by putting the address of the slave device to be contacted into the
address field in the message.When the slave device sends a response
message, it puts its address into the address field of the response so that
the master device knows which device responded.
Address 0 is used as a broadcast address so that all slave devices can
recognize it.When Modbus protocol is used in higher level networks,
broadcasting may not be allowed or replaced in other ways.
Function code:
The function code field in the message frame contains two
characters (ASCII) or 8bits (RTU).The possible code range is 1 ~ 255 in
decimal system.Of course, some codes are applicable to all controllers,
some are applicable to certain controllers, and some are reserved for
future use.
 When a message is sent from the master device to the slave device, the
function code field will tell the slave device what behavior to perform.For
example, to read the input switch state, read the data content of a group
of registers, read the diagnostic state of the slave device, and allow the
program in the slave device to be transferred, recorded and verified.
When the slave device responds, it uses the function code field to
indicate whether it is a normal response (no error) or an error occurs
(called abnormal response).For normal response, the slave device only
responds to the corresponding function code.For abnormal response,
the slave device returns a code equivalent to the normal code, but the
highest bit is logic 1.
Data field:
The data field is composed of a series of two 8-bit byte sets, ranging
from 0000 to ffff.The data field of the message sent by the master device
to the slave device contains additional information. The slave device
must be used to perform the actions defined by the function code.This
includes, for example, discontinuous register addresses, the number of
items to be processed, and the number of actual data bytes in the field.
If no error occurs, the data field returned from the device contains the
requested data.If an error occurs, this field contains the exception code,
which can be used by the master device application to determine the
next action.
In a message, the data field may not exist (0 length).The function
code is sufficient to declare the content of the command.
CRC verification:
When the RTU mode is selected as the character frame, the error
detection field contains a 16bits value (realized by two 8-bit
characters).The content of the error detection domain is obtained by
circular verbosity detection of the message content.The CRC field is
attached at the end of the message. When adding, the low byte is first
followed by the high byte.Therefore, the high byte of CRC is the last byte
of the message sent.
end:
3.5Interval of characters

function code

Register: multi function code reading

Gets the binary values of multiple holding registers of the slave
device.Broadcasting is not supported.The maximum number of request registers is
FF (255).
 Request: the request information defines the starting address of the holding register
and the number of registers to be read.
Slave device Function Starting Number of CRC check
address code 0x04 address registers
8 bits 8 bits 16 bits 16 bits 16 bits

Response: every two bytes of the response information data field represent a register,
and the binary contents of each byte are aligned to the right.
Slave device Function Bytes (n) Data domain CRC check
address code 0x04
8 bits 8 bits 8 bits (N)*8 bits 16 bits

Relevant registers are defined as follows:

Reading and writing data Address range describe Data range
state type
RO F32 247-248 Instantaneous
mass velocity
RO F32 249-250 density
RO F32 251-252 temperature
RO F32 253-254 Instantaneous
volume velocity
RO F32 259-260 Total mass
RO F32 261-262 Total volume

Note: data type F32: use 32bit to store floating-point numbers in single precision IEEE754
format.Each floating-point number contains 4 bytes, which are defined as follows:
SEEEEEEE EMMMMMMM MMMMMMMM MMMMMMMM
S: Sign bit 0- > positive 1 - > negative
E: Order code
M: Decimal part of the tail
For example: 0.4148 million = 12.5,
Note: the IEEE754 data used in our program is represented by reverse order (3-2-1-0),
that is, 00004841 for 12.5.

The data in this example is the data frame reading instantaneous mass flow rate, and
the instrument address is 1 (hex code is 0x01).
Note: register starting address of instantaneous mass flow rate = 247-1 = 246 (hex code is
0xf6).
Request frame: upper computer - > instrument
Data field name RTU sample data (HEX)
Frame head NONE
Instrument address 01
Function code 04
Register start address 00,F6
 Number of registers 00,02
CRC verification 91,F9
Frame end NONE
Response frame: instrument > upper computer
Data field name RTU sample data (HEX)
Frame head NONE
Instrument address 01
Function code 04
Bytes 04
Data domain 00,00,48,41
CRC verification 0D,B4
Frame end NONE
The response frame returns the instantaneous flow data in IEEE754 format
00004841=12.5
Mass flow (32-bit integer address 247) 01 04 00 F6 00 02 91 F9
sent
Return (instantaneous flow rate 30.0t/h) 01 04 04 00 00 F0 41 7F B4
Density (32-bit integer address 249) send 01 04 00 F8 00 02 F0 3A
Return (1.000) 01 04 04 BC 02 80 3F 5E 04
Temperature (32-bit integer address 251) 01 04 00 FA 00 02 51 FA
sent
Return (12.5 ℃) 01 04 04 00 00 48 41 0D B4
Volume flow rate (32-bit integer address 01 04 00 FC 00 02 B1 FB
253) sent
Test code Return (9.999442m3/h) 01 04 04 B7 FD 1F 41 85 C0
Total quality (32-bit integer address 259) 01 04 01 02 00 02 D1 F7
sent
Return (1000000t) 01 04 04 00 24 74 49 5D 79
Total volume (32-bit integer address 261) 01 04 01 04 00 02 31 F6
sent
Return (1000000t) 01 04 04 00 24 74 49 5D 79
The above integer variable (address from 01 04 00 F6 00 10 11 F4
247-261, six variables, 12 registers, 4
registers with empty middle)

MODBUS abnormal response

When the master sends a request to the slave, it expects to receive a normal
response.One of the following four situations is possible for requests from the
master:
If the request from the main device is received from the device, no
 communication error is detected and processed normally, the normal response
is returned from the device;
The slave device does not respond if the request from the master device is not
received due to communication failure.The master device program will finally be
in the request timeout state;
The slave receives a request from the primary device, but detects a
communication error (verification error), the slave does not respond.The master
device program will finally be in the request timeout state;
The slave device receives the request from the master device and does not
detect a communication error, but cannot handle it normally (for example, the
master device requests to read a nonexistent register address). The slave
device will return an exception response to tell the master device the essence of
the exception.

Standard exception response code format:

Slave device Function Exception CRC check
address code code
8 bits 8 bits 8 bits 16 bits

The abnormal response information is different from the normal response

information in the following two points:
Function code:
The normal response function code is the same as the requested function
code.The function code of abnormal response is to set the highest position of
the requested function code as' 1 '.
Data field:
The data field of normal response is the requested information.The data field
of the exception response is the exception code, which declares the condition
causing the slave device exception.
Exception code 0x01: illegal function
The function code in the request is not allowed for the slave device.The
exception code is generated under the following conditions:
When an invalid function code is requested
This agreement only supports function codes 01, 02, 03, 04, 05, 06, 07, 08,
15 and 16
Exception code 0x02: illegal data address
The data address in the request is not allowed for the slave device.The
exception code is generated under the following conditions:
Out of address range of custom coil or register
Write to read-only coil or register
Exception code 0x03: illegal data value
The number of data sent is inconsistent with the protocol:
Exception code 0x06: slave device busy
The slave device is executing program commands that last for a long
 time.The master device needs to resend the instruction when the slave
device is idle.The exception code is generated under the following conditions:
Slave device busy
The slave device cannot respond
The slave device failed to generate a correct response within the timeout
This example assumes that the instantaneous mass flow rate is read, but the illegal data
value is read from the device, so the following fault response frame will be returned.
Fault response frame: Instrument - > upper computer
Data field name RTU sample data (HEX)
Frame head NONE
Instrument address 01
Function code 84
Fault code 03
CRC verification 03,01
Frame end NONE