I am not an expert on the Modbus protocol, and many of the more technical aspects go over my head. Having said that, when using Modbus in the field, the finer, more technical details of the protocol are not necessarily worth knowing. I need to know what I am looking for and how to find it.

Integration networks are becoming increasingly essential in almost every Building Management System; therefore, it is a requirement of any BMS Engineer to at least have a basic understanding of the protocol. Fortunately, there is plenty of information out there detailing everything you could ever need to know about Modbus. Unfortunately, a lot of the information is conflicting, and often there just isn't "all" the information, which leaves you hanging. This post will simplify the information so you have what you need to make it work on your projects.

There are two installations of the Modbus protocol:

• Serial network – RS485
• TCP/IP Network

The result is the same, and often the Modbus point registers are the same, but there are differences between the two installations, if not just the physical installation.

Serial RS485 Modbus

To establish an RS485 Modbus network, a twisted pair cable needs to be installed from the network master to an agent device. Often a single twisted pair cable with a screen will do the job, but these days more and more manufacturers are recommending a dual twisted pair cable, something like a Belden 9842NH. The purpose of 2 pairs is so that one pair can be used for the transmit/receive wires, whilst the other pair can act as a shield or a drain wire. I recommend the two pairs so that you have all bases covered.

When connecting up Modbus devices via an RS485 network, they should be daisy-chained together; any other wiring topology is not supported.

The connections should be kept the same throughout the network: positive to positive, and negative to negative. These may sometimes be labelled as A and B. If these are crossed, this will likely bring the entire network down and create communication alarms within the master controller. It is also worth mentioning that the screen cable should be kept intact throughout the entirety of the network and only earthed at the controller end.

When wiring Modbus serial devices, there is a limit of 32 per network; the above example would be classed as 4 since the controller device takes up an address on the network. There are ways of getting around this limitation by using repeaters and boosters on the network if necessary. The maximum length of the serial network cannot exceed 1200m regardless of boosters and repeaters.

In some situations, it may be necessary to install an end-of-line termination resistor across the communication pair. Typically, a 120 ohm resistor will work ok, but this can be calculated more accurately if need be. More and more devices are coming with built-in termination jumpers which can be used to save the hassle of a resistor when required.

When configuring an RS485 serial Modbus network, you need to set the following within each device:

• Baud rate
• Parity
• Stop bits
• Data bits

These are often configurable via either onboard jumpers or through the software. Keep this at the front of your mind when starting on this type of project – if the onboard jumpers need setting, it is much easier to do them straight out of the box rather than up in a ceiling or anywhere on-site for that matter.

TCP / IP Modbus

To establish a TCP / IP Modbus network, all devices must be connected to the same network either locally or via gateway connections. Typically, these would be wired connections with an Ethernet cable and RJ45 ends, although more devices are now connected via Wi-F; both solutions will do the job.

TCP / IP Modbus is not limited to 32 devices per network like the serial connection is; however, each master (client) device will have its own limitations, and it should be checked before starting to design a system.

Another difference from the RS485 Modbus network is the terminology used. When talking about serial connections, we say "enslaver and slave"; when talking about a "out TCP / IP Mod" we say "Client and server".

The maximum length of each network segment is 100m as per the cat5/6 limitation; Wi-Fi may reach longer distances depending on the type and quality of installation.

When communicating through additional networks, a communication port will need to be opened on the firewall. The default port is 502, but this can be changed if needed.

When configuring the TCP / IP Modbus network, each device will need to be programmed with a unique IP address that is available on the network.

RS485 vs TCP / IP Modbus

The above table is a useful reference point, as manufacturers' literature often does not specify the register the point is on. Depending on the system you are using, you may not be able to search for an input register on an analogue writable object that you have included; this is because an input register is read-only.

Coil Points 00001 – 09999

Think of a coil point as a digital point which is writable, like a digital output.

When reading a coil point, you will see either a true or a false feedback value. It can be one of two states and nothing more. The same applies when you are writing to the point; you can either make it true or false. Coil points are often digital points within a device that are used to trigger certain functions.

Modbus function code 1 = read coil

Modbus function code 5 = write single coil.

Modbus function code 15 = write multiple coils

Discrete Inputs 10001 – 19999

These points are similar to the Coil Point, except they are read-only, like a digital input.

When reading a discrete input, it will return one of two values; it is either true or false and nothing more. Depending on the equipment, it may be labelled as 1 or 0, on or off, etc. These types of points are often used to show the state of a digital input on a controller.

Modbus function code 2 – read input status

Input Registers 30001 – 39999

Input registers are read-only points made up of 16bits of information. An analogue input value would be classed as an input register.

Input registers can be further classified as either signed or unsigned; either way, there is a maximum amount of information that can be displayed due to the 16-bit limitation.

Signed registers can go from -32,768 to 32,767. This is useful for temperature sensors.

Unsigned registers can go from 0 – 65,536. This is useful for consumption meters as negative values are not required.

Modbus function code 4 – read input register

Holding Registers 40001 – 49999

Holding registers are writable points made up of 16bits of information. An analogue output value would be classed as a holding register.

Just like input registers, holding registers can also be signed or unsigned. A 16-bit holding register has the same range limitations as the input register detailed above.

Modbus function code 3 = read holding register.

Modbus function code 6 = write holding register.

Modbus function code 16 = write multiple holding registers

Byte order (MSB / LSB)

This is one of the lesser-known parts of configuring a Modbus network. The reason for this, in my experience, is that more often than not the byte order is always MSB > LSB, which is what most controllers will be set to by default.

MSB = Most significant bit

LSB = Least significant bit

This is to do with the order in which the controller reads the individual bits which make up the register. As we discussed earlier, a standard input or holding register is made up of 16 bits, often starting at bit 0 through to bit 15.

Whilst this setting is often forgotten, you must be aware of it, as it can create issues when reading register values.

All 16-bit register values are read using binary code; this is why the maximum of 65,535 exists, that is 16 ones in binary.

Now let's pretend that we are trying to read a register value using Modbus. We have our network set up ready to go, and all devices are online and working (well, receiving values), but we haven't realised that this device has LSB first instead of MSB.

By default we would be reading a value of 50,401 using MSB order (left to right)

When set to LSB, we are reading a value of 34,595 (right to left).

See why it matters now?

If you aren't aware of this, you can easily waste time scouring the datasheet looking for other possible registers to look up, when you could've had it right all along- just the byte order that was preventing you from getting a correct reading.

FYI, I just used a random set of ones and zeros for the above example. To convert those into a reading, you can use the "programmer" setting on your calculator.

Having a mixture of devices on the same network could cause you an issue if some of the devices use MSB and others use LSB. Some controllers allow you to change the byte order setting per device or point; others only allow it per network.

Easy right?

In my experience, the most difficult part of setting up any integration network is getting the right information from the device you are trying to communicate with. Often the manufacturers' literature is confusing key information. Another frustration is terminology: why isn't there a Modbus standard for electricity meters, for example? They all give the same information, yet they all label it something different? Usually, it is this kind of thing that prevents successful integration between two devices.

Hopefully, this article has provided you with a basic understanding of the subject and will enable you to successfully integrate multiple devices in the future.