What is the modbus-TCP protocol
For communication, our family has defined a very simple data structure, which is called "Protocol data unit" (Protocol Data Unit, PDU)
The protocol data unit is composed of function codes and data, as shown in the following figure:
The length of the function code is 1 byte, and it indicates the function to be executed. For example, common ones: 01 Read the coil; 02 Read discrete input values; 03 Read the value of the hold register; 05 Write individual coils, etc.
The length of the data part ranges from 0 to 252 bytes. It represents the address to be read or the value to be written. Different function codes correspond to different data. For example, the 01 function code has a data of 4 bytes, where the first two bytes represent the address of the coil to be read, and the last two bytes represent the number of coils to be read. As for the 05 function code, its data is also 4 bytes. The first two bytes represent the address of the coil to be written, and the last two bytes represent the value to be written.
There are three types of protocol data units: Request PDU (Request PDU), Response PDU, and Exception Response PDU (Exception Response PDU).
The protocol data unit is the common data structure of our family. It is independent of the underlying physical structure. All three of us brothers use the same protocol data unit. However, when we communicate, we always rely on physical networks. Therefore, the protocol Data Unit needs to be mapped to the physical network, which forms the Application Data Unit (ADU). Due to the differences in the underlying networks, the application data units of my two elder brothers and me are different. Their ADU structures are shown in the following figure:
And my ADU structure is as follows:
It can be seen that my application data unit is based on the protocol data unit and adds one called "MBAP Header" The structure. "MBAP" is the English word "ModBus APlication" The abbreviation, that is,Application data unit" The meaning.
It can be seen that my application data unit is based on the protocol data unit and adds one called "MBAP Header" The structure. "MBAP" is the English word "ModBus APlication" The abbreviation, that is,Application data unit" The meaning.
The MBAP header structure consists of 7 bytes, as shown in the following table
Among them:
Transmission identifier: Used to identify application data units, that is, the pairing between requests and responses; The client initializes this part, and the server copies it to its own ADU.
Protocol identifier: The protocol identifier between systems，0=Modbus；
Length: The length of the data to be sent next, that is, the total length of the unit identifier +PDU, in bytes.
Unit identifier: It is used for station addressing between systems, such as the address of a remote station in an Ethernet + serial link network
This is my ADU structure, namely: MBAP head +PDU. Isn't it very simple? My data transmission employs a method known as "..." "Client/server" This pattern is also the reason why the client/server function description appears in the above table. In fact, many network communications adopt this approach, such as the renowned S7 communication protocol of Siemens. In a serial link, this approach is also known as master-slave communication.
At this point, you might have a doubt. Since in network communication, we usually need to specify the IP address and port number, why is there no relevant content in my ADU?
In fact, this is because I am an application layer protocol, while IP addresses and port numbers belong to transport layer/network layer protocols. Please look at this picture
Logically, I am at the TCP layer. When sending data, my application data unit is first passed down to the transport layer, along with the TCP protocol message.Then it is transmitted to the network layer, along with the IP protocol message. It is then transmitted downward to the data link layer and the physical layer; The receiving process is exactly the opposite. Messages from the corresponding layers are removed layer by layer from the physical layer until they reach the application layer.So when using me for data transmission, it is necessary to use it in conjunction with the TCP/IP protocol.Usually, if you use computer programming, you will need to use SOCKET technology. If you are using PLC programming, usually the manufacturer has already encapsulated the underlying communication into library instructions. You just need to call them directly。For instance, PLCS like Siemens S7-200 SMART/1200/1500 all have ready-made Modbus-TCP instruction libraries. One more point needs to be particularly noted. The port number I'm using is 502. Please make sure it's reserved for me and not occupied by others.