How to connect Modbus TCP/IP?
I.Overview of the Agreement
MODBUS TCP (Transmission Control Protocol) is a widely used serial communication protocol in industrial environments, originally designed for devices connected via serial communication lines. However, over time, MODBUS TCP has also become a mainstream communication protocol for devices connected over networks, typically Ethernet. MODBUS TCP allows devices to communicate over a network, enabling remote monitoring and control.
Modbus-TCP is the implementation of the Modbus protocol on Ethernet, based on the TCP/IP protocol stack. It retains the core functions of Modbus (such as data model and opcodes), but encapsulates data in TCP/IP packets, leveraging the reliability of TCP to ensure accurate data transmission.
II.Basic Structure of MODBUS TCP Protocol
- Client/Server Model:
- The client (usually a PC, PLC, or other control device) initiates the connection and sends requests.
- The server (usually a controlled device or a slave device) receives requests and returns responses.
The communication adopts a client-server model, where the client (master station) initiates requests actively and the server (slave station) responds. The default port used is 502.
2.Transaction Structure:
- Transaction ID: Used to distinguish between different requests and responses.
- Protocol ID: Typically 0, used to identify the MODBUS protocol.
- Length: Data length field.
- Unit Identifier: Derived from the device's address.
- Function code: Indicates the type of request (such as read/write register).
- Data: Specific data related to the function code.
- Error verification: used to verify the integrity of data.
3.Data frame structure:
Data is encapsulated in TCP/IP packets, consisting of two parts: the MBAP message header and the PDU (Protocol Data Unit).
- MBAP telegram header (7 bytes): transaction identifier, protocol identifier, length, and unit identifier.
Transaction identifier (2 bytes): uniquely identifies the request-response pair, ensuring a match.
Protocol identifier (2 bytes): fixed at 0x0000, indicating Modbus-TCP.
Length field (2 bytes): Indicates the number of bytes of the subsequent PDU (including the unit identifier and function code).
Unit identifier (1 byte): equivalent to a slave address, identifying devices on the network.
- PDU (Protocol Data Unit): Function code and data, identical to Modbus-RTU.
Function code (1 byte): defines the operation type (such as reading/writing a coil or register).
Data: Variable length, containing the address and value required for the operation.
III.Communication Process
- Establish Connection: A TCP connection is established between the client and the server. The client initiates a request through the TCP connection (port 502), and the server listens and responds.
- Send Request: The client sends a MODBUS TCP frame containing a function code and necessary data.
- Receive Response: The server processes the request, performs an operation (such as reading a register), and returns a response message. If the operation fails, the server returns an exception response (with the highest bit of the function code set to 1, accompanied by an exception code).
- Close connection (optional): You can close the TCP connection as needed.
IV.Common Function Codes
- 01: Read Coil Status (Read Discrete Input)
- 02: Read Input Status (Read Input Register)
- 03: Read Holding Register (Read the Value of the Holding Register)
- 04: Read Input Register (Read the Value of the Input Register)
- 05: Write Single Coil
- 06: Write Single Register
- 15: Write Multiple Coils
- 16: Write Multiple Registers
- 17: Write Multiple Registers (with Mask)
Ⅴ.Precautions
- Ensure that the MODBUS TCP service on the server side has been started and is listening on the correct port (default is 502).
- Firewall and network settings may need to be appropriately configured to allow TCP traffic to pass through designated ports.
- Use the correct unit identifier and function code to communicate with the device.
- MODBUS TCP has been widely used in industrial automation and monitoring systems due to its simplicity and extensive compatibility. With proper implementation and configuration, remote communication and management between devices can be effectively achieved.