Modbus (RTU/TCP)

Detailed Explanation

Modbus is a serial communication protocol developed in 1979 by Modicon (now automation system) and has become one of the de facto standards of industrial automation today. Because it is open-source and royalty-free, it is supported by nearly all PLC, sensor, drive, controller, and HVAC device manufacturers.

Architecture: master-slave (in newer terminology, client-server) model. A master device (BMS, PLC, SCADA) sends commands to one or more slave devices (sensors, dehumidifiers, motor drivers); slaves only respond to the master's requests and do not broadcast data on their own.

Three main versions: 1. Modbus RTU — over RS-485 serial line, binary encoding, the most common in field use 2. Modbus ASCII — readable character format on RS-485, used in legacy systems 3. Modbus TCP — over Ethernet, port 502, modern architecture

Data types (register types): • Coil (1-bit, read/write): on/off control commands • Discrete Input (1-bit, read-only): status signals (alarm, running) • Holding Register (16-bit, read/write): setpoints, parameters • Input Register (16-bit, read-only): measurement values (temperature, humidity, pressure)

In a typical HVAC application, a dehumidifier exposes: • Holding registers: target RH setpoint, fan speed, defrost mode • Input registers: measured temperature, humidity, operating hours, alarm code • Coils: device on/off, manual defrost, alarm reset • Discrete inputs: running, alarm present, defrost active

Modbus RTU Telegram Structure

Modbus RTU packet format:

[Slave ID] [Function Code] [Data] [CRC-16] 1 byte 1 byte 0–252 byte 2 bytes

Slave ID: 1–247 (device address, 0 broadcast) Function Code: operation type

Common function codes: 0x01 — Read Coils 0x02 — Read Discrete Inputs 0x03 — Read Holding Registers (most common) 0x04 — Read Input Registers 0x05 — Write Single Coil 0x06 — Write Single Register 0x0F — Write Multiple Coils 0x10 — Write Multiple Registers

Example request (read 4 holding registers from Slave 1, starting at address 100): 01 03 00 64 00 04 [CRC]

Example response (4 registers, 16-bit value each): 01 03 08 00 23 00 50 00 78 01 2C [CRC]

Communication parameters (RTU): Baud rate: 9600, 19200 (NKT default), 38400, 57600, 115200 Data bits: 8 Parity: None (common), Even, Odd Stop bits: 1 (2 for None parity) Timeout: 1000–3000 ms (depending on line length)

Practical Example

An industrial facility's BMS monitors 6 NKT silica gel rotor units:

Setup: • Master: industrial PLC + SCADA software • Slaves: 6 NKT AD800-1100 units (each with Modbus RTU) • Line: RS-485, 2-wire, twisted pair shielded, 250 m total length • Termination: 120 Ω resistor at the end of the line • Addressing: devices at 11, 12, 13, 14, 15, 16 (1–10 reserved for spares)

Desired measurements (per device): • Internal temperature (Input register 0x0001) • Internal relative humidity (Input register 0x0002) • Outlet dew point (Input register 0x0003) • Reactivation temperature (Input register 0x0010) • Reactivation heater loading % (Input register 0x0011) • Total operating hours (Input register 0x0020, 32-bit) • Alarm code (Input register 0x0030)

Control commands: • Target outlet dew point (Holding register 0x0100) • Device on/off (Coil 0x0001) • Manual defrost (Coil 0x0010) • Alarm reset (Coil 0x0020)

Trending and alarms: • Polling cycle: all devices every 5 seconds • Alarm level: outlet dew point above setpoint+5°C for 60 seconds • SCADA graph: 24-hour trend, 3-year data archive

With this setup, the operator monitors all rotor performance from a single screen, plans predictive maintenance from temperature/humidity trends, and responds quickly to alarms.

Engineering Note

Practical notes and common pitfalls in Modbus use:

• Address conflicts — if two devices share the same slave ID on the same RS-485 line, responses collide and neither can communicate. Documenting the slave ID list before commissioning is essential. • Line topology — Modbus RTU uses a daisy chain (linear) structure; star topology does not work. Each device must connect directly to the line, with tap stubs no longer than 1 m. • Termination resistor — on long lines (>50 m), a 120 Ω termination at the line end is mandatory; otherwise, signal reflections cause data corruption. • Grounding — the RS-485 shield should be grounded at a single point (master side); double-point grounding creates ground loops. • Migration to Modbus TCP — Ethernet infrastructure is already present in new facilities; Modbus TCP is faster (10–100 Mbps), longer-range (Ethernet switch), easier to debug (Wireshark). Existing RS-485 devices can be integrated via Modbus RTU/TCP gateways. • 32-bit value reads — floats (e.g., dew point) span two 16-bit registers; byte order (big-endian vs little-endian) varies by device — check the documentation. • Modbus security — the protocol is unencrypted by design; SCADA networks should be isolated from the internet, and external access should go through a VPN.

All NKT devices operate over Modbus RTU; optional integration with BACnet/IP via gateway is available. NKT technical documentation packages include register maps, function code lists, and sample SCADA tag files.