Detailed Explanation of ModbusTCP Protocol

Modbus was developed by MODICON in 1979 and is a standard for industrial fieldbus protocols. In 1996, Schneider Electric launched the Modbus protocol based on Ethernet TCP/IP: ModbusTCP.

The Modbus protocol is an application layer messaging protocol that includes three types of messages: ASCII, RTU, and TCP.

The standard Modbus protocol physical layer interfaces include RS232, RS422, RS485, and Ethernet interfaces, using a master/slave communication method.

The data frame of ModbusTCP can be divided into two parts: MBAP + PDU.

MBAP is the message header, with a length of 7 bytes, composed as follows:

PDU consists of Function Code + Data. The function code is 1 byte, and the data length is variable, determined by the specific function.

Function Code

There are four types of Modbus operation objects: coils, discrete inputs, holding registers, and input registers.

According to different objects, the function codes of Modbus are:

More detailed explanation table:

0x01: Read Coils

Read 1 to 2000 consecutive coil statuses from the slave, ON=1, OFF=0.

0x05: Write Single Coil

Write a single output in the slave as ON or OFF, 0xFF00 request output to be ON, 0x000 request output to be OFF.

0x0F: Write Multiple Coils

Force each coil in a sequence in a slave to be ON or OFF, bits set to 1 in the data field request corresponding output bits to be ON, bits set to 0 request corresponding output bits to be OFF.

Read 1 to 2000 consecutive discrete input statuses from a slave.

0x04: Read Input Registers

Read 1 to 2000 consecutive input registers from a remote device.

0x03: Read Holding Registers

Read the contents of a continuous block of holding registers from a remote device.

0x06: Write Single Holding Register

Write a holding register in a remote device.

0x10: Write Multiple Holding Registers

Write a continuous block of registers (1 to 123 registers) in a remote device.

ModBusTcp and serial link Modbus have the same data field; specific data fields can refer to serial Modbus. Here are some ModbusTcp link analysis explanations to assist newcomers in analyzing messages.

Function Code 0x10: Write Multiple Holding Registers, the above two images are incorrect.

Modbus devices can be divided into master (poll) and slave. There is only one master, while there are multiple slaves. The master sends request frames to each slave, and the slave responds. When using TCP communication, the master is the client, actively establishing the connection; the slave is the server, waiting for the connection.

IANA (Internet Assigned Numbers Authority) assigns TCP port number 502 to the Modbus protocol, which is currently the only port number allocated in the instrumentation and automation industry.

Communication Process

In industrial automation control, various concepts such as switching quantity, digital quantity, analog quantity, discrete quantity, and pulse quantity are often encountered, and people can easily confuse these concepts in practical applications. Below are various concepts listed:

Generally refers to the “on” and “off” states of contacts, which are usually represented as “0” or “1” in computer devices.

Switching quantity can be divided into active switching quantity signals and passive switching quantity signals. Active switching quantity signals refer to signals whose “on” and “off” states are powered signals, professionally called step signals, which can be understood as pulse quantities;

Typically includes 220VAC, 110VAC, 24VDC, 12VDC signals; passive switching quantity signals refer to signals whose “on” and “off” states are not powered signals, commonly referred to as dry contacts. The resistance testing method is resistance 0 or infinity.

Many people confuse digital quantity with switching quantity and also with analog quantity. Digital quantity is a discrete physical quantity in both time and quantity, and the signal it represents is a digital signal. Digital quantity consists of signals made up of 0 and 1, encoded to form regular signals. The quantized analog quantity becomes digital quantity.

The concept of analog quantity corresponds to digital quantity but can be transformed into digital quantity after quantization. Analog quantity is a continuous physical quantity in both time and quantity, and the signal it represents is an analog signal. Any value taken during the continuous change of analog quantity is a specific meaningful physical quantity, such as temperature, voltage, current, etc.

Discrete quantity is the physical quantity obtained by discretizing analog quantity. That is, any instrument or device cannot have a completely accurate representation of the analog quantity since they all have a sampling period, during which the physical quantity’s value remains unchanged, while the actual analog quantity is changing. This discretizes the analog quantity into a discrete quantity.

Pulse quantity refers to the signal that instantaneously changes voltage or current from one value to another. After quantization, if its change continues regularly, it is digital quantity; if it changes from 0 to a fixed value and remains unchanged, it is switching quantity.

In summary, analog quantity is a physical quantity that continuously changes in time and quantity during a certain process. In practical applications, all instruments and devices for collecting external data have a sampling period, and the collected data only changes at the beginning of the next sampling period; during the sampling period, its value does not change with the change of analog quantity.

Thus, the analog signal is discretized. For example, if a device’s sampling period is 1 second, and the temperature collected at the fifth second is 35 degrees, while the temperature at the sixth second is 36 degrees, the device can only indicate the temperature at the fifth second as 35 degrees and at the sixth second as 36 degrees, while at the fifth and a half seconds, it can only indicate 35 degrees, but the actual analog quantity is 35.5 degrees. This discretizes the analog signal. The collected data is thus discretized and no longer a continuous analog signal.

Since computers only recognize two signals, 0 and 1, that is, switching quantity signals, numerical values are represented by digital strings. Due to computational limitations, these digital strings cannot be infinitely long, meaning their expressed precision is also limited. Taking temperature as an example, due to the limitations of digital strings, the precision of expressed temperature can only reach 0.1 degrees; values smaller than this unit cannot be indicated. Thus, discrete quantities must be quantified into digital quantities. For instance, a temperature of 35.68 degrees would be expressed as 35.6 degrees.