Decoding Modbus RTU on a Scope - Page 1
Forum section: electronics / beginners

author: A.Williamson
author_rank: Contributor
timestamp: August 18, 2023, 08:00:42 pm
content: Hi all,Today I'm trying to look at a Modbus data line with an oscilloscope in order to figure out how to spoof one of the slaves on the network.According to the Modbus RTU protocol, a data frame (ex. a two byte register read) requires a minimum of 6 bytes and 3.5bytes start time. There must not be more than 1.5bytes of idle time between bytes of a frame.Each byte is eleven bits: one start bit (LOW), eight data bits, one parity bit (EVEN), one stop bit (HIGH).I don't have a given baud rate so I'm trying to deduce that using bit length. I measure the minimum bit length to be ~26uS which would correspond to a baud rate of 38400. In this case, the length of a byte would be ~286.5uS.I'm going to attach some pictures that show what I'm seeing on the scope. These are captures of the master only. There is nothing attached to the master right now except for a 120R termination resistor. My probes are on either side of it and the differential pair are matching up nicely. I only attached both probes because I wasn't sure which is the inverted output. I'm using CH1 to be the non-inverted line.First picture shows a the data that I captured using a single capture. You can see what I assume are individual frames of Modbus RTU master transmissions.The second picture shows what I assume to be a frame of the data. I measure ~1.34ms to be the frame length.The third picture shows a measure of the first non-idle state of the data line. the ~31.5s LOW which does not correlate to a bit length. Though it is about 3.5x 8.68uS -- a fact that has plagued me when I was trying to figure out the baud rate (was it 115200 baud?)The fourth picture is a measurement what I believe to be one bit - either the first or the second one depending on whether the first state is indeed a bit.Fifth picture shows another bit, this is the 3rd state and I'm including it to show how consistent the bit lengths are.The sixth picture shows where I begin to try to isolate where the bytes begin and end. An 11bit byte should be ~286.5uS at this baud rate so I'm not in love with the 292uS measurement here.The seventh picture shows a measurement of 286uS starting at the second transition.If the sixth picture is a byte, the bits would be: 0 1011 1111 1 0If the seventh picture is a byte (assuming my assumption about inverted channel is wrong), the bits would be: 0 1000 0001 1 0In each case, the start and stop bits are the same level. Something is not right. The parity bit for the first byte is even, which is good. The parity bit for the second byte is not good.I'm not seeing anything like the 3.5byte start time (should be held high for 3.5bytes before the start bit LOW)Any suggestions?Thanks!

author: BeBuLamar
author_rank: Super Contributor
timestamp: August 18, 2023, 09:00:18 pm
content: I have not use a scope to decode Modbus before so I have no experience there. But I am curious as to which devices are in your network? Which is the master and which are the slaves? The master trying to send data to the slaves or requesting data from the slaves or both. Also what kind of data are they? Holding registers, inputs, outputs etc..

author: langwadt
author_rank: Super Contributor
timestamp: August 18, 2023, 09:14:03 pm
content: get some "fail-safe bias" resistors so the bus isn't just floating when not driven, the line should idle at "1" it is just another uart

author: A.Williamson
author_rank: Contributor
timestamp: August 18, 2023, 10:12:14 pm
content: Quote from: BeBuLamar on August 18, 2023, 09:00:18 pmAs captured on the scope, there is nothing but the master. The network is typically one master and one slave. The master is shown on the scope captures. I'm not sure what exactly is contained in the message sent by the master. I'm expecting an address of 0x01 on the slave.Quote from: langwadt on August 18, 2023, 09:14:03 pmThe transceiver is a SN65HVD72. Accorcing tohttps://www.ti.com/lit/an/slyt514/slyt514.pdf?ts=1692340796785, no failsafe bias resistors are needed?

author: langwadt
author_rank: Super Contributor
timestamp: August 18, 2023, 10:18:57 pm
content: Quote from: A.Williamson on August 18, 2023, 10:12:14 pmit may not need them but it is a lot easier to follow what is going on when the undriven idle is a clearly defined state

author: A.Williamson
author_rank: Contributor
timestamp: August 18, 2023, 10:19:07 pm
content: Here is a waveform from a different instance of the same pcb. The data looks a bit different but it has similar features such as a slightly longer first bit, and 26us bit lengths.Pictures show different cursor measurements. I added the math feature which is offset by -4v.

author: A.Williamson
author_rank: Contributor
timestamp: August 18, 2023, 10:41:22 pm
content: Quote from: langwadt on August 18, 2023, 10:18:57 pmLooking at the circuit, there are failsafe resistors already on the pcb. This is not a device of my own design.I'm not sure why they're using a +12v line for the pullup.

author: A.Williamson
author_rank: Contributor
timestamp: August 18, 2023, 10:46:33 pm
content: The voltage divider created by the failsafe resistors puts the B line at 1.45v idle and the A line at 1.94V idle, right?

author: langwadt
author_rank: Super Contributor
timestamp: August 18, 2023, 10:57:32 pm
content: sicne you have access just probe D on the transcieveror get something like this,https://www.ebay.com/itm/201414902344

author: tautech
author_rank: Super Contributor
timestamp: August 18, 2023, 11:57:14 pm
content: If I can make a few suggestions......Use the blue Print button to capture USB screenshots so to have the menu visible so we can see relevant settings and not the Save/Recall settings.Press Trigger level to return the horizontal trigger setting to mid display.In Utility> Reference set Horizontal to Position to not have the horizontal position shoot off the display with different timebase settings. Then you can position it near the left edge of the display and zoom in on a packet and not have it off the display.Use an Edge triggerDetermine the max packet length and set trigger Holdoff for a little more.With these settings we the ability to capture possibly 100's of packets with Stop or another trigger setting and zoom and pan through the capture. For best waveform fidelity set mem depth to max and use 1 channel on each ADC,eg 1&3, 2&4 etc.

author: tautech
author_rank: Super Contributor
timestamp: August 19, 2023, 02:22:13 am
content: I had a few minutes to grab some CAN bus screenshots that show some settings which may be of help.

author: Siwastaja
author_rank: Super Contributor
timestamp: August 19, 2023, 06:00:01 pm
content: Also remember that many if not most modbus devices communicate using 8N1, even by default, despite the fact such mode is completely illegal in modbus specification.

author: BeBuLamar
author_rank: Super Contributor
timestamp: August 19, 2023, 08:42:05 pm
content: I generally would connect the master to a device I use to pretend the slave so I can figure out what the master is requesting from the slave.

author: A.Williamson
author_rank: Contributor
timestamp: August 21, 2023, 02:05:02 pm
content: Thanks everyone for the input. I am going to try using a rs485-> serial converter with wireshark to monitor the bus. Right now I'm thinking that because the slave is not connected, I'm only reading error messages. A friend helped me to that conclusion. Perhaps I'm missing some initial messages and that by the time I grab the data, the master has already started sending non-standardized error messages.