In this issue, we will take a detailed look at the family of industrial protocols. There are many industrial protocols, some proprietary and some universal. We will analyze a few commonly used and mainstream protocols.
Before we begin, let’s review the relationship between the OSI seven-layer model and the TCP/IP model, as well as the position of industrial Ethernet protocols:
From the diagram, we can see that industrial Ethernet protocols operate at the application layer of TCP/IP, so they possess all the technologies of traditional IT protocols, although there are differences at the application layer. Next, we will analyze the types of industrial Ethernet protocols in detail.
MODBUS Protocol
MODBUS is divided into two types: MODBUS on Serial Line: This means the protocol operates on fieldbus; MODBUS on Serial Line has two modes: ASCII mode: When the controller is set to communicate in ASCII (American Standard Code for Information Interchange) mode on the Modbus network, each 8-bit byte in the message is sent as two ASCII characters. The main advantage of this method is that the time interval for sending characters can reach 1 second without errors. RTU mode: When the controller is set to communicate in RTU (Remote Terminal Unit) mode on the Modbus network, each 8-bit byte in the message contains two 4-bit hexadecimal characters. The main advantage of this method is that it can transmit more data than ASCII mode at the same baud rate. Therefore, we often hear about the MODBUS-RTU protocol.The other is MODBUS on TCP/IP, which means it can run on Ethernet links. The application layer of Modbus TCP still uses the Modbus protocol, which is simple and efficient; the transport layer uses the TCP protocol and utilizes TCP port 502, making it user-friendly and reliable; the network layer uses the IP protocol, which is used for addressing on the Internet, so Modbus TCP can be used not only on local area networks but also on wide area networks and the Internet.The protocol model is as follows: 
ModBus Frame Format:
Modbus serial link ADU protocol is typically used on physical links such as RS-485 or RS-232.
| Component | Length | Detailed Explanation |
|---|---|---|
| Address Field | 1 byte | Function: On a serial link, a master station can connect to multiple slave stations (such as sensors and instruments). This address is used to uniquely identify a slave device on the network.Range: 0-247 (0 is usually used for broadcast address).Analogy: Like the “room number” or “workstation number” written on an envelope. |
| Function Code | 1 byte | Function: Tells the slave what operation to perform. This is the starting part of the PDU.Common Examples:• <span>01</span>: Read Coil Status• <span>03</span>: Read Holding Registers• <span>06</span>: Write Single Register• <span>16</span>: Write Multiple Registers |
| Data | N bytes | Function: Specific information required by the function code. For example, the starting address of the register to be read, the number to be read, the data to be written, etc. |
| Error Check | 2 bytes (RTU) | Function: Used to detect errors during data transmission (such as noise interference causing data bits to change). In Modbus RTU, this isCRC16 cyclic redundancy check code. The receiver will recalculate the CRC and compare it with the CRC in the message; if they do not match, the message will be discarded. |
It is a self-contained message that includes all information: “Who to send to (address)”, “What to do (function code)”, “How to do it/What the result is (data)”, and “Is the data correct (check)”.
Modbus TCP/IP ADU: When the Modbus protocol runs on a TCP/IP network, since the TCP protocol itself already provides reliable connections, packet ordering, and error retransmission mechanisms, there is no need to repeat the address and error checking functions. These functions are replaced by a new message header—the MBAP message header.
| Component | Length | Detailed Explanation |
|---|---|---|
| MBAP Message Header | 7 bytes | MBAP stands for Modbus Application Protocol Header. It is specifically designed for TCP/IP encapsulation and contains the following four fields:1. Transaction Identifier (2 bytes): Generated by the client (master) to pair requests and responses. Since TCP is a stream protocol, this identifier can distinguish concurrent requests.2. Protocol Identifier (2 bytes): For the Modbus protocol, this value is always <span>0</span>. It is used to distinguish other possible protocols.3. Length (2 bytes): Indicates how many bytes follow (including the 1 byte unit identifier and the entire PDU).4. Unit Identifier (1 byte):This is equivalent to the “address field” in the serial link. In a TCP/IP network, it is usually used to identify serial link devices connected behind a gateway (for example, multiple RTU slaves may be connected behind a TCP/IP to RTU gateway). If directly connected to TCP devices, it can sometimes be ignored. |
| Function Code | 1 byte | Identical to the function code in the serial link. For example, <span>03</span> is still read holding registers. |
| Data | N bytes | Identical to the data field in the serial link. |
It utilizes the TCP protocol to ensure reliable data transmission, thus eliminating the need for CRC checks. The MBAP message header manages sessions and routing over TCP connections, with the unit identifier taking on a role similar to the “address field” in the serial link. The most critical point is that the PDU part (function code + data) is universal across both protocols! This allows the same set of application software to easily adapt to different physical layers (only requiring the addition or removal of different “envelopes”).
ModBus-Tcp Message Structure:
In these protocol data, the function code plays a critical role. The MODBUS common function codes are defined as follows:
l is well-defined function codes.
l guarantees uniqueness.
l MODBUS organization can change.
l publicly proven.
l has available consistency testing.
l proven in MB IETF RFC.
l includes defined common assignment function codes and reserved function codes for future use.
The following is a table of function codes and their corresponding functions:
Common Read Function Codes:
Common Write Function Codes
ModBus-Tcp Request Message
ModBus-Tcp Response Message:
Correspondence of ModBus-Tcp Message Fields in Traffic Data Packets:
MODBUS Packet Analysis
WireShark Packet Capture:
Function Code 03 Request PLC Data Analysis:
PLC Response Function Code 03 Data Analysis:
Data Analysis for Writing to PLC
The above is an analysis of the MODBUS protocol family. The reason for going into such detail about this protocol is primarily to facilitate future industrial control security efforts, enabling security protection for the entire ICS system based on the principle of minimizing security risks.