GB/T 19582.3-2008Modbus industrial automation network specification -- Part 3: Modbus protocol implementation guide over TCP/IP (English PDF)

5.1 Protocol Description

5.1.1 Overall communication structure

See Figure 2 ~ Figure 3.

The Modbus TCP/IP communication system may include different types of devices.

---Modbus TCP/IP client and server devices connected to the TCP/IP network;

---Interconnection devices, such as bridges, routers or gateways that interconnect the

TCP/IP network and a serial link subnet, which allows Modbus serial link client and server terminal devices to be connected.

Figure 3 -- General Modbus Frame

Modbus protocol defines a simple protocol data unit (PDU) independent of the fundamental communication layer. Modbus protocol mappings on a specific bus or network can introduce some additional fields into the application data unit (ADU).

The client initiating Modbus transaction processing establishes a Modbus application data unit.

This function code instructs the server what operation to perform.

5.1.2 Modbus application data unit over TCP/IP

See Figure 4.

This clause describes the encapsulation of Modbus request or response over a Modbus TCP/IP network.

Figure 4 -- Modbus Request/Response over TCP/IP

A special header is used on TCP/IP to identify Modbus application data unit. This message header is called MBAP header (Modbus Application Protocol header).

This message header differs from the Modbus RTU application data unit used over serial links in several ways.

---The Modbus “slave station address” field, typically used on Modbus serial links, is replaced by a single-byte “unit identifier” in the MBAP message header. This “unit identifier” is used for communication via devices such as bridges, routers and gateways, which use a single IP address to support multiple independent Modbus terminal units.

---All Modbus requests and responses are designed in a way that allows the receiver to verify the end of the message. For Modbus PDU with a fixed-length function code, the function code alone is sufficient. For function codes transmitting a variable amount of data in a request or response, the data field includes the number of bytes.

---When transmitting Modbus protocol via TCP, even if the message has been divided into multiple information packets for transmission, additional length information must be transmitted in the MBAP header, so that the receiver can identify message boundaries.

The existence of explicit and implicit length rules, and the use of CRC-32 error checking codes (on Ethernet), reduce undetected request or response message errors to an extremely low level.

5.1.3 MBAP header description

The MBAP header includes the following fields, as shown in Table 1.

Table 1 -- Fields of MBAP Header

The message header is 7 bytes long.

Transaction processing identifier. used for transaction processing pairing. In the response, the

Modbus server replicates the transaction processing identifier from the request.

Protocol identifier. used for multiplexing within the system. A value of 0 is used to identify the

Modbus protocol.

Length. the length field is the number of bytes in the continuation fields, including the unit identifier and data fields.

Unit identifier. this field is used for routing within the system. It is typically used for communication between Modbus+ or Modbus serial link slave stations through gateways over

TCP-IP Ethernet and Modbus serial links. The Modbus client sets this field in the request, and the server must return this field with the same value in response.

All Modbus/TCP ADUs are sent via TCP to the registered port 502.

NOTE. different fields are encoded using the most significant byte stored at the lowest address.

5.2 Modbus Function Code Description

The standard function codes used on the Modbus application layer protocol are detailed in GB/T

19582.1-2008.

6.1 Modbus Component Structure Model

See Figure 5 ~ Figure 7 and Table 2.

......