Modbus RTU: protocol architecture & RS-485 network commissioning

1. The PLC (Master) sends a command over the cable to a sensor (Slave): “Hey, Modbus device #5, give me the value from your Modbus register #100”.
2. The microcontroller inside the sensor receives this packet from the cable.
3. The microcontroller’s firmware decodes the request and realizes: “Aha, it’s asking for register #100. I know that my pressure data is stored under this number”.
4. At this moment, the microcontroller places the physical memory address where the “pressure” variable is stored onto its internal Address Bus.
5. The memory (RAM) returns the pressure value over the internal Data Bus back to the processor.
6. The processor takes this value, packs it into a Modbus response, and sends it over the cable back to the controller.

Basic register properties:

Before PLCs were introduced, control logic was implemented in hardware using electromagnetic relays. A relay has a physical coil. Apply current to the coil – the relay clicks, the motor starts.

Example: we send the value 1 via Modbus to Coil #5, and a light turns on, a valve opens, or a fan starts on the device. We can also read this Coil to check if the light is currently on.

Before PLCs, “changing the logic” meant physically re-soldering and rewiring cables, rather than “changing the program in the PLC”.

Here is what an elevator control cabinet looked like in the last century; the video shows electromagnetic relays clicking: https://www.youtube.com/watch?v=WT1yfXAs548.

Basic register properties:

Example: a door opening sensor is connected to the controller. If the door is open, Discrete Input #10 will hold a

1. If closed – 0. We (the Master) can only ask “is the door open?”.

We cannot send a “make the door closed” command to this register, because it’s just a physical position sensor.

Basic register properties:

Example: we have a temperature sensor. It measures the room temperature and places the value 245 (meaning 24.5 °C) into Input Register #20.

The computer regularly reads this register to draw a graph. Again, the computer cannot write 300 in there – writing a number to the sensor won’t make the room warmer. The sensor updates this value itself.

Basic register properties:

Why “Holding”?

To hold means to store or retain. This is memory that holds the device’s configuration. It is the most popular data type in modern Modbus.

Often, manufacturers are lazy and just stuff everything (both sensors and relays) into Holding Registers to avoid dealing with multiple entities.

Example: we want a Variable Frequency Drive to spin a motor at 1500 RPM. We write the number 1500 into Holding Register #100. The device “holds” this number in its memory and starts spinning the motor at that speed.

We can read this register at any time to recall what speed is set.

This is the ID of the device on the RS-485 line that the Master is addressing.

Addresses from 1 to 247 are available.

If the Master puts a 0 here, it is a Broadcast request – all devices on the network will hear and execute the command, but no one will reply (to avoid a data collision on the line).

This is the instruction: what exactly needs to be done.

Recall the discussion about Coils and Holding Registers. This is where the Master specifies which table it wants to interact with:

• 0x01 – Read Coils;
• 0x02 – Read Discrete Inputs;
• 0x03 – Read Holding Registers (The most frequent command!);
• 0x04 – Read Input Registers;
• 0x05 – Write Single Coil (turn a relay on/off);
• 0x06 – Write Single Holding Register (set a parameter);
• 0x10 – Write Multiple Holding Registers.

The details of the request go here. The contents of this block depend on which function code we used.

If we requested to read Holding Registers, we must specify in the data:

• Which address to start reading from (e.g., from register #100);
• How many registers to read (e.g., 2 registers);
• If this is a response from a sensor, the actual temperature or pressure values will be located in the “data” field.

RS-485 networks are often laid out in factories next to powerful motors, VFDs, and EMI generators. An electromagnetic spike can “hit” the cable, turning a zero into a one.

Before sending, the device runs the entire frame through a complex mathematical formula, gets a 2-byte CRC (Cyclic Redundancy Check) result, and glues it to the end.

The receiving device takes the received frame, performs the exact same math, and compares its result with what arrived at the end of the package. If the numbers don’t match, it means the frame got corrupted on the way, and it is simply ignored.

When there is no transmission on an RS-485 line, all nodes switch their transmitters to a high-impedance state (receive mode, where the device’s output acts as if it is disconnected from the circuit).

As a result, the line becomes inactive and has no forced logical level.

In this state, the differential pair can be susceptible to electromagnetic interference induced by external sources (motors, switching power supplies, adjacent cables, etc.).

Interference can cause random changes in the differential voltage between lines A and B.

Under certain conditions, the receiver might interpret this as the start of a transmission (UART start bit; we discussed this in the previous article), leading to the reception of corrupt data.

To prevent this, a fail-safe biasing circuit is used, which forces a defined state on the line during idle periods.

The biasing circuit is implemented using resistors:

• A pull-up resistor connected to line B and the power supply;
• A pull-down resistor connected to line A and ground.

As a result, a stable differential voltage (B > A) corresponding to a logical “1” is maintained during the idle state.

This guarantees that when there is no transmission, the line stays in a defined state and is immune to noise.

Line biasing (Bias) must be enabled in only one place across the entire long RS-485 line (otherwise, resistors from different devices will conflict and “drag down” the line).

Usually, this bias is enabled on the Master (on our Communication Module, PLC, or PC). On all other devices (slaves, sensors, VFDs), the bias must be disabled (None) or is not present in the hardware at all.

This is a primitive error-checking mechanism for a single byte (not to be confused with CRC, which protects the entire frame).

It works simply: the system counts how many ones are in our 8 data bits.

Modes:

• Even parity: The system adds a 0 or 1 at the end so that the total number of ones in the package becomes an even number (2, 4, 6, 8).
  • Example: We send the byte 10110001. There are four ones here. Four is an even number. Therefore, the parity bit will be 0.
  • Example 2: We send 10110000. There are three ones (odd). Therefore, the parity bit will be 1, making the total number of ones four.
• Odd parity: The exact same thing, but the system ensures the total number of ones is always odd.
• None (No parity): The parity bit is not sent at all. This is the most common configuration today.

Why is this needed?

If, while the byte is traveling down the wire, interference turns a zero into a one, the receiving device will recount the ones, notice that the parity doesn’t match, and immediately discard this byte as corrupted without waiting for the CRC check of the entire frame.

This is the end-of-byte signal. After the data (and parity bit) are transmitted, the transmitter must hold the line in a state of “silence” for a specific duration.

This duration is measured in bits. There can be 1 or 2 stop bits. This gives the receiving device a few microseconds to digest the received byte and prepare for the next one (Start bit).

1 stop bit (most common variant): ... DATA → 1:

• Standard: 8-N-1 (8 data, No parity, 1 stop);
• Faster (fewer overhead bits);
• Extremely widely used.

2 stop bits: ... DATA → 1 1:

• Gives the receiver more time;
• Useful for poor line quality;
• Old hardware;
• Long cables.

In the industry, ready-made terminators or devices with built-in line matching are used – these can be separate modules or connectors with an integrated termination circuit.

Besides the resistor itself, they often include biasing circuits to prevent a “floating” signal during idle times – which we discussed earlier. It is crucial to remember that bias should be enabled only on one side.

Another important aspect is ease of maintenance: the terminator can be toggled on or off with a switch without dismantling the wiring. This is critical during commissioning and diagnostics.

Such solutions make the line:

• Resistant to reflections;
• Predictable in its idle state;
• Easy to service.

Examples of industrial terminators:

Wiren Board – WB-T120

The most compact and cheapest option. Simply a 120 Ω resistor in a tiny casing with a terminal block. Installed at the ends of an RS-485 line, very compact: 12×17×35 mm. No DIN rail mounting, just hangs on the wires:

Phoenix Contact – PSI-TERMINATOR-PB-TBUS

A full-fledged industrial module. An active terminator for PROFIBUS/RS-485 with redundant power, galvanic isolation, and DIN rail mounting. Supports switchable termination and line biasing:

Siemens – 6ES7972-0DA00-0AA0

A terminating resistor for PROFIBUS/MPI networks (MPI is Siemens’ proprietary network) – a PROFIBUS connector with termination built right into the plug. A classic for Siemens systems:

Importantly, this module works as part of an ET 200S (Remote I/O) system:

[S7 PLC in central cabinet]
        |
        | PROFIBUS cable (same as RS-485)
        |
[ET 200S station at Machine #1]   ← "ET 200S" System
  [IM] [DI] [DO] [AI] [TERM]
        |
| PROFIBUS continues
        |
|[ET 200S station at Machine #2]
  [IM] [DI] [DO] [TERM]

This is a page from the datasheet for the SinoTimer DDS529MR energy meter.

We see the exact same ADU structure we broke down earlier!

Additionally, it shows that voltage is represented as a float, stored in Input Registers (function code 04), and occupies 2 registers (2 words/registers, meaning 4 bytes).

On startup, we initialize myCommLoad once; the port is the “Hardware identifier” of our RS-485 module.

You can also specify an Alias – TIA Portal will suggest a list of available options automatically.

For initialization, we have a small initState state machine:

• Start with state = 0, where we set the initialization signal to TRUE;
• Move to state = 1, turn off the initialization signal to create a falling edge, and read the DONE and ERROR signals when ready;
• If initialization fails, log the error code into the container and block execution;
• Upon successful initialization, start the main logic state machine.

Main logic state machine:

• state = 0: set the read signal if the interface is not BUSY; immediately transition to state = 1;
• state = 1: turn off the read signal, creating a falling edge, and read the DONE and ERROR signals when ready;
• If an error occurs, log the error code into the container and go to the error handler at state = 99;
• On success, go to state = 2;
• state = 2: start the timer to pause between requests;
• Wait for the timer to trigger, reset it, and return to state = 0.

Question 1: If the function code is 04 (Read Input Register), why is DATA_ADDR = 30001?

• The address 30001 solves two problems at once: it determines the function code (04) and calculates the physical wire address (00).
• The first digit in 30001 (the 3) is never sent over the cable. It is an internal command for the PLC block itself.

For the PLC:

• Address 0xxxx → The PLC uses function 01 or 05.
• Address 1xxxx → The PLC uses function 02.
• Address 3xxxx → The PLC uses function 04.
• Address 4xxxx → The PLC uses function 03 or 06.

Question 2: If the starting register number is 00, why does the address end in 0001?

• This is a historical conflict between hardware and software engineers:
• Microcontroller developers (and the Modbus protocol itself at the wire level) always start counting from zero; to them, the first memory register is 0000, the second is 0001, etc.
• Electrical engineers (for whom the first PLCs were made) were used to counting from one (the first motor, the first relay, the first register).
• Therefore, in documentation (and PLC block settings), the first register is designated as 1 (which means 30001 for function 04).

Full SCL code for the state machine:

// Initialization
IF NOT #isInitialized THEN
    CASE #initState OF
        0: // Send request
            #initReq := TRUE; // Explicit trigger set
            #initState := 1;

        1: // Wait response
            #initReq := FALSE; // Explicit trigger reset
            
            IF #myCommLoad.DONE THEN
                #isInitialized := TRUE;
                #workState := 0;
            ELSIF #myCommLoad.ERROR THEN
                #lastErrorStatus := #myCommLoad.STATUS;
                #initState := 999;
            END_IF;
            
        999: // Emergency stop
            ; // Block forever
    END_CASE;
    
    // Initialization call
    #myCommLoad(REQ := #initReq,
                "PORT" := "Local~CM_1241_(RS422_485)_1",
                BAUD := 9600,
                PARITY := 0,
                MB_DB := #myMaster);
    
    RETURN; // Don't go further until initialized
END_IF;

// State machine (logic)
CASE #workState OF
0: // Send request when not BUSY
IF NOT #myMaster.BUSY THEN
#modbusReq := TRUE;
#workState := 1;
END_IF;

    1: // Wait response
        #modbusReq := FALSE;
        
        IF #myMaster.DONE THEN
            #workState := 2;
        ELSIF #myMaster.ERROR THEN
            #lastErrorStatus := #myMaster.STATUS;
            #workState := 99;
        END_IF;
        
    2: // Pause between requests
        #pauseTimer(IN := TRUE,
                    PT := T#2S);
        IF #pauseTimer.Q THEN
            #pauseTimer(IN := FALSE,
                        PT := T#2S);
            #workState := 0;
            #lastErrorStatus := 0;
        END_IF;
        
    99: // Error handling
        #workState := 2;
END_CASE;

// Request when needed
#myMaster(REQ := #modbusReq,
MB_ADDR := 1,
MODE := 0,
DATA_ADDR := 30001,
DATA_LEN := 2,
DATA_PTR := "MB_DATA".Value);

A classic Modbus register holds 16 bits (2 bytes).

But what if we need to transmit a float or a large number that takes up 32 bits (4 bytes)? They won’t fit into a single register.

The solution is to split the large 32-bit number into two halves and place them in two adjacent 16-bit registers (for example, into 40100 and 40101).

The difficulty is that the Modbus standard (written in 1979) does not dictate in what order these two registers or the bytes within them should be transmitted. Therefore, every hardware manufacturer implements it whichever way suits their processor best.

Let’s represent our large 32-bit number as 4 bytes (letters): A B C D, where A is the most significant byte, and D is the least significant.

Here is how different systems might send these 4 bytes down the line:

Big-endian – reads from left to right, the way we naturally read. The most significant byte comes first. This is the standard in networking technologies (internet protocols).

Little-endian – everything is turned inside out. The least significant byte comes first. Why so weird? Because this is exactly how the architecture of Intel (x86) processors inside our computers works. It makes it faster for them to perform mathematical calculations in memory.

Word-swapped (Middle-endian) – the most frequent source of headaches. The bytes inside the register are placed correctly (in human-readable order), but the registers (words) themselves have swapped places.

Why is Word-swapped the most common in Modbus?

• The Modbus standard itself requires transmitting 16-bit registers most significant byte first (Big-endian). The sensor complies: it honestly sends the first half of the number, then the second.
• But this data is received by a PLC or a PC running a SCADA system (which typically use Little-endian architecture). The PC grabs the first arriving register and puts it into the low half of its memory, and the second into the high half. As a result, the two halves of the number swap places (Word Swap).

There is also a rare fourth variant – Byte-swapped B A D C, where the registers are in their correct places, but the bytes inside them are flipped.

We add two more variables:

• currentIndex of type Int – to track which Modbus register is currently being read;
• lastErrorIndex of type Int with a default value of -1 – to track which register caused an error during reading.

Full SCL code:

// Initialization
IF NOT #isInitialized THEN
    CASE #initState OF
        0: // Send request
            #initReq := TRUE; // Explicit trigger set
            #initState := 1;
            
        1: // Wait response
            #initReq := FALSE; // Explicit trigger reset
            
            IF #myCommLoad.DONE THEN
                #isInitialized := TRUE;
                #workState := 0;
            ELSIF #myCommLoad.ERROR THEN
                #lastErrorStatus := #myCommLoad.STATUS;
                #initState := 999;
            END_IF;
            
        999: // Emergency stop
            ; // Block forever
    END_CASE;
    
    // Initialization call
    #myCommLoad(REQ := #initReq,
                "PORT" := "Local~CM_1241_(RS422_485)_1",
                BAUD := 9600,
                PARITY := 0,
                MB_DB := #myMaster);
    
    RETURN; // Don't go further until initialized
END_IF;

// State machine (logic)
CASE #workState OF
    0: // Send request when not BUSY
        IF NOT #myMaster.BUSY THEN
            #modbusReq := TRUE;
            #workState := 1;
        END_IF;
        
    1: // Wait response
        #modbusReq := FALSE;
        
        IF #myMaster.DONE THEN
            #workState := 2;
        ELSIF #myMaster.ERROR THEN
            #lastErrorStatus := #myMaster.STATUS;
            #workState := 99;
        END_IF;
        
    2: // Pause between requests
        #pauseTimer(IN := TRUE,
                    PT := T#2S);
        IF #pauseTimer.Q THEN
            #pauseTimer(IN := FALSE,
                        PT := T#2S);
            #workState := 0;
            #lastErrorStatus := 0;
        END_IF;
        
    99: // Error handling
        #workState := 2;
END_CASE;

// Request when needed
#myMaster(REQ := #modbusReq,
          MB_ADDR := 1,
          MODE := 0,
          DATA_ADDR := 30001,
          DATA_LEN := 2,
          DATA_PTR := "MB_DATA".Value);

Communication and Configuration Errors

Modbus Protocol Errors