IT Lab艾鍗學院技術Blog: 嵌入式系統常用的通訊協定-RS485/Modbus

RS485:

為半雙工(同一時間只能選擇傳送或接收的動作)
為差動傳輸，使用纜線兩端(Ｄ＋、Ｄ－)的電壓差來表示傳遞訊號
常用於單機傳送(Master)，多機接收(Slave)的通訊鏈結。可將數個感應裝置的數值回傳給Master

Modbus over RS485:

Modbus是一種串列通訊協定
Modbus為master/slave架構。一個裝置為Master節點，其他節點為slave。
每一個slave裝置都有一個唯一的位址/ID (1~247)
Since a single byte is normally used to define the slave address and each slave on a network requires a unique address, the number of slaves on a network is limited to 256. The limit defined in the modbus specification is even lower at 247.
master和slave之間走的Modbus 協定其封包格式有分ASCII 或RTU兩種
ASCII 為文字模式, 用character 傳送, RTU 為binary 模式傳送
封包格式: Slave ID | Function Code | Data | CRC

RTU 訊息格式

Information is stored in the Slave device in four different tables.
Two tables store on/off discrete values (coils) and two store numerical values (registers). The coils and registers each have a read-only table and read-write table.
Each table has 9999 values.
Each coil or contact is 1 bit and assigned a data address between 0000 and 270E.
Each register is 1 word = 16 bits = 2 bytes and also has data address between 0000 and 270E.

Coil/Register Numbers	Data Addresses	Type	Table Name
1-9999	0000 to 270E(9999)	Read-Write	Discrete Output Coils
10001-19999	0000 to 270E	Read-Only	Discrete Input Contacts
30001-39999	0000 to 270E	Read-Only	Analog Input Registers
40001-49999	0000 to 270E	Read-Write	Analog Output Holding Registers

Coil/Register Numbers can be thought of as location names since they do not appear in the actual messages. The Data Addresses are used in the messages.For example, the first Holding Register, number 40001, has the Data Address 0000. The difference between these two values is the offset.
Each table has a different offset. 1, 10001, 30001 and 40001.

只有Data Address(Offset)才出現在送出的Message 中, 如何知道查的是那一張表呢?
答案是利用Function Code 來決定

What is a function code?

The second byte sent by the Master is the Function code. This number tells the slave which table to access and whether to read from or write to the table.

Function Code (Command) 3 is to read 4xxx registers, and 4 for 3xxx registers.

Function Code	Action	Table Name
01 (01 hex)	Read	Discrete Output Coils
05 (05 hex)	Write single	Discrete Output Coil
15 (0F hex)	Write multiple	Discrete Output Coils
02 (02 hex)	Read	Discrete Input Contacts
04 (04 hex)	Read	Analog Input Registers
03 (03 hex)	Read	Analog Output Holding Registers
06 (06 hex)	Write single	Analog Output Holding Register
16 (10 hex)	Write multiple	Analog Output Holding Registers

Example:

Read Holding Registers (FC=03)

Request
This command is requesting the content of analog output holding registers # 40108 to
40110 from the slave device with address 17.
11 03 006B 0003 7687
11: The Slave Address (11 hex = address17 )
03: The Function Code 3 (read Analog Output Holding Registers)
006B: The Data Address of the first register requested.
( 006B hex = 107 , + 40001 offset = input #40108 )
0003: The total number of registers requested. (read 3 registers 40108 to 40110)
7687: The CRC (cyclic redundancy check) for error checking.
Response
11 03 06 AE41 5652 4340 49AD
11: The Slave Address (11 hex = address17 )
03: The Function Code 3 (read Analog Output Holding Registers)
06: The number of data bytes to follow (3 registers x 2 bytes each = 6 bytes)
AE41: The contents of register 40108
5652: The contents of register 40109
4340: The contents of register 40110
49AD: The CRC (cyclic redundancy check).

Read Coil Status (FC=01)

Request
This command is requesting the ON/OFF status of discrete coils # 20 to 56
from the slave device with address 17.
11 01 0013 0025 0E84

11: The Slave Address (11 hex = address17 )
01: The Function Code 1 (read Coil Status)
0013: The Data Address of the first coil to read.
( 0013 hex = 19 , + 1 offset = coil #20 )
0025: The total number of coils requested. (25 hex = 37, inputs 20 to 56 )
0E84: The CRC (cyclic redundancy check) for error checking.
Response
11 01 05 CD6BB20E1B 45E6
11: The Slave Address (11 hex = address17 )
01: The Function Code 1 (read Coil Status)
05: The number of data bytes to follow (37 Coils / 8 bits per byte = 5 bytes)
CD: Coils 27 - 20 (1100 1101)
6B: Coils 35 - 28 (0110 1011)
B2: Coils 43 - 36 (1011 0010)
0E: Coils 51 - 44 (0000 1110)
1B: 3 space holders & Coils 56 - 52 (0001 1011)
45E6: The CRC (cyclic redundancy check).
The more significant bits contain the higher coil variables. This shows that coil 36 is off (0) and 43 is on (1). Due to the number of coils requested, the last data field1Bcontains the status of only 5 coils. The three most significant bits in this data field are filled in with zeroes.