Overview
Modbus was released in 1979 by the predecessor of Schneider Electric and has become a de facto standard industrial serial protocol. It defines function codes, register mapping, and error checking rules. Common implementations include RS-485-based Modbus RTU, text-based Modbus ASCII, and Modbus TCP running over Ethernet. IoT edge gateways often collect RTU data via serial ports and encapsulate it into MQTT/HTTP through cellular modules for cloud uploading, enabling remote monitoring and predictive maintenance.
With Cellular Gateways
Care should be taken regarding polling cycles and cellular latency: polling too many slaves under long RTT may cause timeouts. Retry, timeout, and batch read settings should be configured reasonably to avoid avalanche-style retransmissions in weak networks. In terms of security, pure Modbus is unencrypted, so VPN or private APN should be used when crossing public networks.
Frequently Asked Questions
Station number conflicts, inconsistent baud rates, and poor termination or grounding can lead to intermittent communication failures; on the cloud side, misinterpreting the sequence of 16-bit and 32-bit registers can result in value jumps. Documented point tables and byte order are critical.
Function Codes and Exception Responses
Common function codes include Read Holding Registers (03), Read Input Registers (04), Write Single Register (06), Write Multiple Registers (10), etc.; in case of an exception, the slave returns the function code with the highest bit set to 1 along with an exception code, and the master needs to retry or alert accordingly. Batch reading can reduce polling times, but the single-frame length is limited by the RTU and TCP adaptation layers. It is recommended to read back and verify before write operations to prevent accidental writing to safety interlock points. When interfacing with a cellular gateway, it is suggested to combine periodic polling with event-driven reporting to reduce uplink pressure.
Slave Simulation and Documentation Management
During the development phase, software slave simulation point tables can be used to accelerate joint debugging; before mass production, the real PLC firmware version must be verified. Point tables should be versioned and consistent with electrical schematics and HMI screens, with changes going through the review process. For Modbus TCP across public networks, TLS tunnels or IP whitelists should be used to avoid exposure in plain text on the Internet.
Register addresses and the check field
Modbus treats a slave’s data as a table arranged by address. The function code says whether this transaction reads holding registers, reads input registers, or writes one register or a contiguous run of them. On an exception, the slave sets the high bit of the function code and returns an exception code, telling the master that the function is unsupported, the address is illegal, or the device is busy. RTU uses a CRC at the end of the serial frame to catch bit errors. TCP places the same protocol data unit in an Ethernet message and matches request and response with a transaction identifier. It no longer frames on a gap between characters. Addresses in the protocol often start at 0, while drawings often start at numbers such as 40001. A difference of one, or of a base address, reads the neighboring variable.
When a cellular gateway sends the data to the cloud, the poll period must be longer than serial timeout times retries times slave count, with a cellular round trip left over. With many slaves and a slow link, read a contiguous address range in one request rather than one request per register. If writing a coil or a register can affect an interlock, read it back before writing, and limit the address range that may be written across the public network. A plain serial link has no encryption. Across the public network it belongs only on a private network or inside a tunnel.
Baud rate, termination, and byte order
One slave with a different baud rate or parity scrambles the frame gap for the whole message. The symptom is a random timeout that disappears when that instrument is swapped out. A termination resistor on only one end, or on three ends, reflects and causes occasional CRC errors, more visibly after the sun heats the cabinet. A 32-bit measurement split across two registers, with the high word and low word reversed relative to the cloud template, suddenly becomes a large negative once it crosses a threshold. When station addresses collide, two slaves answer together, the master fails the check, and someone restarts the cellular module. A write of multiple registers longer than the frame the slave allows is truncated by the adaptation layer and writes half a setpoint.
One version of the point list should state address, type, word order, scale, and unit, and a change should be reviewed with the electrical drawing. When the need is a meaning rather than a register number, map it to a tag in OPC. How the gateway and the supervisory screen divide the work is covered in SCADA: the screen should not poll a slave on the public network point by point. Before go-live, check exception codes against the real slave firmware. A simulator that succeeds at everything hides an illegal address.
When the point list is reviewed, check four things item by item: the conversion between protocol address and drawing number, the register type, the word order, and the scale. Any one of them agreed only verbally, and not written into the version, reads the wrong value after the people change. Baud rate, parity, and stop bits must be the same for every station on the bus, and termination resistors go only at the two ends. When forwarding through a gateway, give each slave its own timeout. One offline slave should not stall the poll of the others. List separately the addresses that may be written from the public network, and require a read-back after the write. Exception codes should become alarms, not ordinary timeouts that are retried. Otherwise an illegal address is hit once a second. After the simulator passes, retest the frame-length limit on the slave firmware that is actually in the field.
A timeout for an offline slave must not drag the rest of the bus with it. If the value read back after a write does not match the target, alarm and stop writing further. Print word order and scale on the cover of the point list, and raise the version when the cloud template changes. On the public-network side, open only the read-only addresses that were listed. Leave interlock writes on the local network.