© Copyright Brainboxes Ltd
8 Modbus TCP Protocol
Introduction
The Modbus protocol is a messaging structure which was developed by Modicon in 1979, and later released as
an open and free-to-use standard. The full standards documents can be downloaded from
http://www.modbus.org/specs.php for reference, but this chapter provides a basic introduction.
There are several variants of the protocol, which use the same basic messages encapsulated in different ways
for transfer over serial lines (Modbus RTU and Modbus ASCII) or TCP/IP networks (Modbus TCP).
Modbus is a query-response protocol. Master devices send out query messages, and slave devices send back a
response message for each query addressed to them. In the case of Modbus TCP, the slave device is a TCP/IP
server which waits for a connection to be made to it (e.g. a Brainboxes ED device) and the master is the device
which initiates the TCP connection (e.g. a PLC, HMI or PC).
Modbus organises the data to be transferred between devices into four address spaces or “data tables”, each
of which has 65536 addressable entries. These are
Discrete inputs – Single-bit (Boolean) values which can only be read.
Coils – Single-bit (Boolean) values which can be written as well as read.
Input registers – 16-bit (Boolean) values which can only be read.
Holding registers – 16-bit (Boolean) values which can be written as well as read.
The Modbus standard does not specify how inputs and outputs should be related to addresses in these data
tables, or how the values inside the 16-bit registers should be structured. These are up to each manufacturer
to decide, although some de facto standard practices have developed over the years.
Each Modbus message has a ‘Function Code’ which specifies the type of operation which is being requested by
the master. The function types supported by Brainboxes ED devices are the ones needed for reading and
writing the four address spaces:
Slave ID
As well as the addresses for the inputs, coils, and registers of a device, there is also an “address” to identify a
particular Modbus slave, known as the Slave ID or Unit Identifier. This is important for the serial bus versions
of Modbus, where a message sent by a device is seen by all the devices on the bus, and the Slave ID identifies
which slave devices the message is related to. In Modbus TCP the Slave ID is somewhat redundant as the
destination of the message is already defined by the IP address of the TCP packet. Modbus-capable
Brainboxes devices can be configured to either respond to Slave IDs 0 and 255, as required by the Modbus TCP
specification, or to any valid Slave ID (0 to 247, and 255) for convenience.
Addressing notations
Unfortunately, the long history of Modbus has resulted in there being several common ways for the data
addresses to be written. When it comes to setting up other devices or software to communicate with
Brainboxes Modbus TCP products, you will need to identify the type of address notation it is using so that you
can pick the appropriate type of address from the product data table.
To Next Page
Loading...