The universal Modbus RS485 Protocol Guide presented in this article is a starter guide for anyone that starts to use any kind of Andivi Mobus sensors – temperature, CO2, humidity, pressure, and VOC sensors.
Modbus RS485 Protocol Guide Index:
1.) What is the Modbus Protocol?
2.) What is RS485?
3.) Modbus Messages – Master / Slave
4.) Modbus Message Format
5.) The Serial Transmission Modes
6.) Modbus Message Timing (RTU Mode)
7.) How Characters are Transmitted Serially
8.) Error Checking Methods
9.) Modbus Sensor Configuration Examples
10.) Modbus Sensor Addressing Examples
11.) Main Andivi Modbus Sensor families
12.) More information on Modbus Sensors & Modbus Protocol
What is the Modbus Protocol?
Let’s start the Modbus RS485 Protocol Guide with some basic understanding of the Modbus protocol.
The Modbus protocol “defines a message structure that controllers will recognize and use, regardless of the type of networks over which they communicate. It describes the process a controller uses to request access to another device, how it will respond to requests from the other devices, and how errors will be detected and reported. It establishes a common format for the layout and contents of message fields.” – from Modbus Protocol Reference Guide, PI-MBUS-300 Rev. J.
What is RS485?
Before we dig deep into the topic we decided to explain also the basics of RS485 in the Modbus RS485 Protocol Guide.
RS485 or EIA (Electronic Industries Association) RS485 is a balanced line, half-duplex transmission system allowing transmission distances of up to 1.2 km.
The table below summarises the RS-485 Standard:
| Mode of Operation: | Differential |
| Nr. of Drivers and Receivers: | 32 Drivers and 32 Receivers |
| Maximum cable length: | 1200 meters |
| Maximum data rate: | 10 M baud |
| Maximum common mode voltage: | 12 to -7 Volts |
| Minimum Driver Output Levels (Loaded): | +/- 1.5 |
| Minimum Driver Output Levels (Unloaded): | +/- 6 |
| Drive Load (Ohms): | 60 (min) |
| Driver Output short circuit current Limit (mA): | 150 to Gnd, 250 to -7 or 12 V |
| Minimum receiver input Resistance 12 (kohms): | 12 |
| Receiver sensitivity: | +/- 200mv |
Modbus Messages – Master / Slave
Communication on a Modbus Network is initiated (started) by a “Master” with a “query” to a “Slave”.
The “Slave“ which is constantly monitoring the network for “Queries” will recognize only the “Queries” addressed to it and will respond either by performing an action (setting a value for example) or by returning a “response”.
Only the Master can initiate a query.
In the Modbus protocol the master can address individual slaves, or, using a special “Broadcast” address, can initiate a broadcast message to all slaves.
Modbus Message Format
The Modbus protocol defines the format for the master’s query and the slave’s response.
The query contains the device (or broadcast) address, a function code defining the requested action, any data to be sent, and an error-checking field.
The response contains fields confirming the action taken, any data to be returned, and an error-checking field. If an error occurred in receipt of the message, or if the slave is unable to perform the requested action, the slave will construct an error message and send it as its response.
Modbus Message Format Query
The below example shows a request for a single 16-bit Modbus Register:
| Slave Address | Function Code | Start Address (Hi) | Start Address (Lo) | Number of Points (Hi) | Number of Points (Lo) | Error Check (Lo) | Error Check (Hi) |
| Slave Address | 8-bit value representing the slave being addressed (1 to 247), 0 is reserved for the broadcast address. The SPR and Integra products do not support the broadcast address. |
| Function Code | 8-bit value telling the addressed slave what action is to be performed. (3, 4, or 16 are valid for Integra). |
| Start Address (Hi) | The top (most significant) eight bits of a 16-bit number specifying the start address of the data being requested. |
| Start Address (Lo) | The bottom (least significant) eight bits of a 16-bit number specifying the start address of the data being requested. |
| Number of Points (Hi) | The top (most significant) eight bits of a 16-bit number specifying the number of registers being requested. |
| Number of Points (Lo) | The bottom (least significant) eight bits of a 16-bit number specifying the number of registers being requested. |
| Error Check (Lo) | The bottom (least significant) eight bits of a 16-bit number representing the error check value. |
| Error Check (Hi) | The top (most significant) eight bits of a 16-bit number representing the error check value. |
Modbus Message Format Response
The below example shows a response for a single 16-bit Modbus Register:
| Slave Address | Function Code | Byte Count | Data (Hi) | Data (Lo) | Error Check (Lo) | Error Check (Hi) |
| Slave Address | 8-bit value representing the address of slave, which has just responded. |
| Function Code | 8-bit value which, when a copy of the function code in the query, indicates that the slave recognised the query and has responded. (See also Exception Response). |
| Byte Count | 8-bit value indicating the number of data bytes contained within this response |
| Data (Hi) | The top (most significant) eight bits of a 16-bit number representing the register(s) requested in the query. |
| Data (Lo) | The bottom (least significant) eight bits of a 16-bit number representing the register(s) requested in the query. |
| Error Check (Lo) | The bottom (least significant) eight bits of a 16-bit number representing the error check value. |
| Error Check (Hi) | The top (most significant) eight bits of a 16-bit number representing the error check value. |
Modbus Message Format Exception Response
If an error is detected in the content of the query (excluding parity errors and Error Check mismatch), the function code will be modified to indicate that the response is an error response (called an exception response), and the data bytes will contain a code that describes the error. The exception response is identified by the function code being a copy of the query function code but with the most-significant bit set to logic ‘1’.
| Slave Address | Function Code | Error Code | Error Check (Lo) | Error Check (Hi) |
| Slave Address | 8-bit value representing the address of slave, which has just responded. |
| Function Code | 8 bit value which is the function code in the query OR’ed with Hex (80), indicating the slave either does not recognize the query or could not carry out the action requested. |
| Error Code | 8-bit value indicating the nature of the exception detected. (See “Exception Codes“ in the section “Product Information for a list of SPR and Integra supported codes). |
| Error Check (Lo) | The bottom (least significant) eight bits of a 16-bit number representing the error check value. |
| Error Check (Hi) | The top (most significant) eight bits of a 16-bit number representing the error check value. |
The Serial Transmission Modes
There are two MODBUS serial transmission modes, ASCII and RTU.
ASCII Mode
In ASCII (American Standard Code for Information Interchange) mode, each 8-bit byte in a message is sent as two ASCII characters. The main advantages of this mode are that it allows time intervals of up to one second to occur between characters without causing a timeout error and that messages may be monitored more easily on a simple ASCII terminal.
In ASCII mode messages begin with the ‘:’ character (Hex (3A)) and end with a Carriage Return – Line Feed pair (Hex (0D) and Hex (0A)).
The format for each byte in ASCII mode is:
| Coding System | Hexadecimal, ASCII characters 0-9, A-F One hexadecimal character contained in each ASCII character of the message, each 8-bit byte to be transmitted requires two characters. |
| Bits per Byte | 1 start bit 7 data bits, least significant bit sent first 1 parity bit for even/odd parity; no parity bit for no parity, 1 stop bit if parity is used; 2 stop bits if no parity |
| Error Check Field | Longitudinal Redundancy Check (LRC) |
RTU Mode
In RTU (Remote Terminal Unit) mode, each 8-bit byte in a message contains two 4-bit hexadecimal characters. The main advantage of this mode is that its greater character density allows better data throughput than ASCII for the same baud rate, however, each message must be transmitted in a continuous stream.
The format for each byte in RTU mode is:
| Coding System | 8-bit binary, hexadecimal 0-9, A-F Two hexadecimal characters contained in each 8-bit field of the message |
| Bits per Byte | 1 start bit, 8 data bits, least significant bit sent first 1 parity bit for even/odd parity; no parity bit for no parity 1 stop bit if parity is used; 2 stop bits if no parity |
| Error Check Field | Cyclical Redundancy Check (CRC) |
Modbus Message Timing (RTU Mode)
A Modbus message has defined beginning and ending points. The receiving devices recognize the start of the message, read the “Slave Address” to determine if they are being addressed and know when the message is completed so that they can use the Error Check bytes to confirm the integrity of the query.
Partial messages can be detected and discarded:
In RTU mode, messages start with a silent interval of at least 3.5 character times.
The first field then transmitted is the device address.
The allowable characters transmitted for all fields are hexadecimal 0-9, A-F. Devices monitor the network bus continuously, including during the ‘silent’ intervals. When the first field (the address field) is received, each device decodes it to find out if it is the addressed device. If the device determines that it is the one being addressed it decodes the whole message and acts accordingly, if it is not being addressed it continues monitoring for the next message.
Following the last transmitted character, a silent interval of at least 3.5 character times marks the end of the message. A new message can begin after this interval.
The entire message frame must be transmitted as a continuous stream. If a silent interval of more than 1.5 character times occurs before the completion of the frame, the receiving device flushes the incomplete message and assumes that the next byte will be the address field of a new message.
Similarly, if a new message begins earlier than 3.5 character times following a previous message, the receiving device will consider it a continuation of the previous message. This will result in an error, as the value in the final CRC field will not be valid for the combined messages.
How Characters are Transmitted Serially
When messages are transmitted on standard MODBUS serial networks each character or byte is sent in this order (left to right):
With Parity Checking (11 bit characters)
| Start | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | Parity | Stop |
Without Parity Checking, 2 Stop Bits (11 bit characters)
With Parity Checking (11 bit characters)
| Start | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | Stop | Stop |
Going from theory into practice in this Modbus RS485 Protocol Guide, here is an example of addressing an Andivi Modbus sensor.
Error Checking Methods
Standard Modbus serial networks use two error checking processes, the error check bytes mentioned above check message integrity whilst Parity checking (even or odd) can be applied to each character in the message.
The master is configured by the user to wait for a predetermined timeout interval. The master will wait for this period of time before deciding that the slave is not going to respond and that the transaction should be aborted.
Care must be taken when determining the timeout period from both the master and the slaves’ specifications. The slave may define the ‘response time’ as being the period from the receipt of the last bit of the query to the transmission of the first bit of the response. The master may define the ‘response time’ as period between transmitting the first bit of the query to the receipt of the last bit of the response. It can be seen that message transmission time, which is a function of the baud rate, must be included in the timeout calculation.
Standard Modbus serial networks use two error checking processes, the error check bytes mentioned above check message integrity whilst Parity checking (even or odd) can be applied to each character in the message.
The master is configured by the user to wait for a predetermined timeout interval. The master will wait for this period of time before deciding that the slave is not going to respond and that the transaction should be aborted.
Care must be taken when determining the timeout period from both the master and the slaves’ specifications. The slave may define the ‘response time’ as being the period from the receipt of the last bit of the query to the transmission of the first bit of the response. The master may define the ‘response time’ as period between transmitting the first bit of the query to the receipt of the last bit of the response. It can be seen that message transmission time, which is a function of the baud rate, must be included in the timeout calculation.
Parity Checking
If parity checking is enabled – either Even or Odd Parity is specified – the quantity of “1’s” will be counted in the data portion of each of the eight bits in the character.
The parity bit will then be set to a 0 or 1 to result in an Even or Odd total of “1’s”.
Note that parity checking can only detect an error if an odd number of bits are picked up or dropped in a character frame during transmission, if for example two 1’s are corrupted to 0’s the parity check will not find the error.
If No Parity checking is specified, no parity bit is transmitted and no parity check can be made. An additional stop bit is transmitted to fill out the character frame when 2 stop bits are selected. If No Parity checking is specified and one stop bit is selected the character is effectively shortened by one bit.
CRC Checking
The error check bytes of the Modbus messages contain a Cyclical Redundancy Check (CRC) value that is used to check the content of the entire message.
The error check bytes must always be present to comply with the Modbus protocol; there is no option to disable it.
The error check bytes represent a 16-bit binary value, calculated by the transmitting device. The receiving device must recalculate the CRC during receipt of the message and compare the calculated value to the value received in the error check bytes. If the two values are not equal, the message should be discarded.
The error check calculation is started by first pre-loading a 16-bit register to all 1’s (i.e. Hex (FFFF)) each successive 8-bit byte of the message is applied to the current contents of the register.
Note: only the eight bits of data in each character are used for generating the CRC, start bits, stop bits and the parity bit, if one is used, are not included in the error check bytes. During generation of the error check bytes, each 8-bit character is exclusive OR’ed with the register contents. The result is shifted in the direction of the least significant bit (LSB), with a zero filled into the most significant bit (MSB) position. The LSB prior to the shift is extracted and examined. If the LSB was a 1, the register is then exclusive OR’ed with a pre-set, fixed value. If the LSB was a 0, no exclusive OR takes place.
This process is repeated until eight shifts have been performed. After the last (eighth) shift, the next 8-bit byte is exclusive OR’ed with the register’s current value, and the process repeated. The final contents of the register, after all the bytes of the message have been applied, is the error check value. In the following pseudo-code “ErrorWord” is a 16-bit value representing the error check values.
Modbus Sensor Configuration Examples
Besides theory, the Modbus RS485 Protocol Guide includes some practical examples regarding addressing and configuration of Andivi Modbus Temperature Humidity VOC sensors.
DIP-Switch #2 on every Modbus Sensor is for Addressing. Below you can see an extract from the Andivi Modbus Datasheet.
Modbus Sensor Addressing Examples
DIP-Switch #2 on every Modbus Sensor is for Addressing. Below you can see an extract from the Andivi Modbus Datasheet.
Meaning of DIP Switch #2 settings:
= ON = Switch is up
= OFF = Switch is down
Main Andivi Modbus Sensor families
Main Andivi Modbus Sensor Families presented below consist of several different variations of Modbus sensors and Modbus Weather Stations that vary in casing type, IP protection grade, etc.
More info on Modbus Sensors & Modbus Protocol beyond the Modbus RS485 Protocol Guide
- The Complete Modbus RS485 Sensor Datasheet for temperature, CO2, humidity, VOC and pressure sensors in PDF here.
- Mounting guidelines for sensors & general sensor installation recommendations,
- Modbus Application Protocol (PDF),
- For specific questions feel free to contact our support team at support@andivi.com.
