Analysis of Modbus TCP Protocol
The message formats of Modbus TCP and Modbus UDP are the same, and the difference between them is actually the difference between TCP and UDP. Therefore, the following analysis focuses on the protocol of Modbus TCP. The difference between Modbus TCP and Modbus Rtu (Modbus ASCII) is shown in the following figure:
From the above figure, it can be seen that Modbus TCP, based on Modbus serial communication, removes checksum (because TCP itself has checksum) and device address (Modbus TCP weakens device address and replaces it with IP address), and adds MBAP packet header (occupying 7 bytes). Below is an analysis and explanation of MBAP:
| 域 | Length | Instructions | client | Server |
|---|---|---|---|---|
| transaction ID | 2 bytes | Identification of Modbus request/response transaction processing | Client startup | Copy response |
| Protocol Identifier | 2 bytes | 0=Modbus protocol | Client startup | Copy response |
| Length | 2 bytes | Total number of bytes after length | Client startup | Server startup |
| Unit identifier | 1 byte | Slave identification of serial links or other buses | Client startup | Copy response |
Below is an analysis of specific messages. The message format of Modbus protocol on Ethernet link is as follows:
| transaction ID | Protocol Identifier | Length | Unit identifier | function code | data |
|---|---|---|---|---|---|
| 2 bytes | 2 bytes | 2 bytes | 1 byte | 1 byte | N bytes |
With the above theoretical foundation, a detailed analysis will be conducted on each functional code as follows:
Read output coil
The format for sending messages is as follows:
Message meaning: Read the status values of the output coils from server 1, starting from address 0x13=19, corresponding to address 00020, with a coil quantity of 0x1B=27, i.e. read the status values of 27 coils from address 00020-00046.
It is worth noting that the starting address in the protocol refers to the index, and the following address refers to the specific address. For any storage area, the index starts from 0, but the corresponding specific address is related to the storage area, such as the output coil, where 0 corresponds to 00001; Input coil, 0 corresponds to 10001; Input register, 0 corresponds to 30001; Keep the register, 0 corresponds to 40001.
The format of the returned message is as follows:
Return message meaning: Return the status values of 27 coils, including coils 00020-00046, output from server 1. The number of returned bytes is 4, which are CD 6B B2 05.
CD=1100 1101 corresponds to 00020-00027
6B=0110 1011 corresponds to 00028-00035
B2=1011 0010 corresponds to 00036-00043
05=0000 0101 corresponds to 00044-00046
Read input coil
The format for sending messages is as follows:
Message meaning: Read the status values of 29 coils from the input coil of server 1, starting at address 0xC4=196 and corresponding to address 10197, with a coil quantity of 0x1D=29.
The format of the returned message is as follows:
Return message meaning: Return the status values of 29 coils, including coils 10197-10225, from the input station of server 1. The number of returned bytes is 4, which are CD 6B B2 05.
CD=1100 1101 corresponds to 10197-10204
6B=0110 1011 corresponds to 10205-10212
B2=1011 0010 corresponds to 10213-10220
05=0000 0101 corresponds to 10221-10225
Read and hold register
The format for sending messages is as follows:
Message sending meaning: Read the value of two registers, starting from address 0x6B=107 and corresponding to address 40108, from the holding register of server 1's slave station. The number of registers is 0x02=2.
The format of the returned message is as follows:
Return message meaning: Return the values of two registers, 40108-40109, held by the slave station of server 1. The number of returned bytes is four, which are 02 2B, 01 0640108, corresponding to the value 0x022B, and 40109, corresponding to the value 0x0106.
Read input register
The format for sending messages is as follows:
Message sending meaning: Read the input register of server 1 from the slave station, starting at address 0x6B=107, corresponding to address 30108, with a register quantity of 0x02=2, that is, read the values of two registers held by server 1 from address 30108-30109.
The format of the returned message is as follows:
Return message meaning: Return the values of two registers, 30108-30109, from the input station of server 1. The number of returned bytes is four, which are 02 2B, 01 0630108, corresponding to the value 0x022B, and 30109, corresponding to the value 0x0106.
Pre set single coil
The format for sending messages is as follows:
Message sending meaning: Preset the value of a single coil from server 1's slave station. The coil address is 0x00AC=172, corresponding to address 00173. The disconnection flag 0xFF00 indicates set, and 0x000 indicates reset, that is, set the output coil 00173 from server 1's slave station.
The format of the returned message is as follows:
Return message meaning: The original message of the preset order output coil is returned.
Pre set single register
The format for sending messages is as follows:
Message sending meaning: Preset the value of a single hold register for server 1's slave station. The register address is 0x0087=135, corresponding to address 40136, and the write value is 0x039E. That is, preset the value of the slave station's hold register 40136 as 0x039E.
The format of the returned message is as follows:
Return message meaning: The preset order maintains the register and returns the original message.
Pre set multiple coils
The format for sending messages is as follows:
Message meaning: Preset the values of multiple coils for server 1's slave station. The coil address is 0x0013=19, corresponding to address 00020. The number of coils is 0x0A=10, and the written value is 0xCD00. That is, preset the value of coil 00020-00027=0xCD=1100 110100028-00029=0x00=0000 0000 for slave station 1.
The format of the returned message is as follows:
Return message meaning: The preset multi output coil return message is returned after removing the number of bytes and specific bytes from the original message.
Preset Multiple Registers
The format for sending messages is as follows:
Message sending meaning: Preset the values of multiple registers in the slave station of server 1, with register address 0x0087=135, starting address 40136, register quantity 0x02=2, ending address 40137, and write values 0xCD00 and 0x0A10, that is, preset slave station register 40136=0x010540137=0x0A10.
The format of the returned message is as follows:
Return message meaning: The preset multi hold register returns a message after removing the number of bytes and specific bytes from the original message.
Modbus Technology QQ Communication Group
Leave a Reply