Modbus/TCP

Modbus Basics

it sends a message containing a device address, followed by a function code, any data that maybe required, and an error check field. The addressed slave responds with a similar message structure. Typically it repeats back its address and the function code, and then sends a field indicating the number of bytes of data it is sending, followed by the data and the error check field.

Slave addresses can range from 1 to 247. Function codes include several common ones typically used in all applications, and additional ones that may be implemented in specific cases. Common function codes include: Read Coil Status (01), Read Input Status (02), Read Holding Registers (03) and Read Input Registers (04).

When a master sends a message to a slave it expects to receive a valid response within certain length of time. If the slave does not receive the message, or if the slave receives the message but an error is detected, it does not respond. If the slave cannot respond appropriately for some other reason (e.g. it does not recognize the function code), it will return a message containing an exception response.

Modbus/TCP is a much more recent development, created to allow Modbus ASCII/RTU protocol to be carried over TCP/IP-based networks. Modbus/TCP embeds Modbus messages inside TCP/IP frames. Although the implementation is fairly simple, characteristics associated with networking add some challenges. For example, because Modbus masters expect and require responses to their polls within a certain time frame, the non- deterministic (and other) aspects of TCP/IP networks have to be considered.

Modbus/TCP sets up connections between nodes on the network, sending requests via TCP in a half-duplex fashion. TCP allows multiple requests to be ‘pipelined’, or queued in a buffer waiting to be serviced. Modbus/TCP has the capability to use transaction identifiers (sequence numbers), but some early manufacturers of Modbus/TCP equipment did not use them. In some cases this can create problems for Modbus/RTU devices connected to the network through interfaces. If a request from a master is lost, or contains an improper function code, the slave does not respond. The master may re- initiate the request, or there may be other requests in the pipeline. Responses to later, or other, requests may become out of sync and the master may match the wrong response with a request. The resulting symptoms could range from appearing to receive wrong data from a slave, to slaves going off-line, to a gradually slowing down of response time.

Manual Documentation Number: MES1A/MES1B-2106m

PN7138-rev001

B&B Electronics Mfg Co Inc – 707 Dayton Rd - PO Box 1040 - Ottawa IL 61350 - Ph 815-433-5100 - Fax 815-433-5104 – www.bb-elec.comB&B Electronics Ltd – Westlink Commercial Park – Oranmore, Galway, Ireland – Ph +353 91-792444 – Fax +353 91-792445 – www.bb-europe.com