Modbus TCP Explained: Underlying Logic for Industrial Automation Ethernet
t introduces Modbus TCP protocol, frame structure, function codes and underlying communication logic for industrial automation.
Modbus TCP Protocol
- Modbus TCP Protocol Introduction
Modbus TCP is a TCP/IP‑based implementation of the Modbus protocol, used to transmit Modbus protocol data over Ethernet networks. Modbus adopts a master‑slave architecture: one device acts as the master station and other devices work as slave stations. The master sends requests, and slave stations respond and return data. This communication mode allows one master station to communicate with multiple slave stations simultaneously to realize centralized management and control.
Client‑server communication mechanism and network architecture in industrial automation
Main features of Modbus TCP:
TCP/IP‑based communication Modbus TCP leverages the standard TCP/IP protocol stack as its underlying transport layer and communicates over Ethernet. It brings good network compatibility and broad application scope.
Client‑server architecture Modbus TCP uses the classic client‑server model. Clients (typically PLC, HMI and other devices) send Modbus requests, and servers (Modbus slave devices) respond and return data.
Modbus function codes Modbus TCP inherits Modbus function codes, including read/write single/multiple registers, read/write single/multiple coils and other common functions. This guarantees compatibility with existing Modbus applications.
Message format Modbus TCP messages consist of the Modbus Application Protocol Header (MBAP) and Modbus function code / data. The MBAP header contains fields such as transaction identifier, protocol identifier, length and unit identifier for message identification.
Port number Modbus TCP uses port 502 by default, which is the standard TCP/IP port for Modbus.
Connection management Modbus TCP clients actively establish TCP connections to servers. One connection can be reused for multiple Modbus requests. Servers process and reply to client requests.
Performance Compared with traditional serial Modbus RTU, Modbus TCP delivers better performance in terms of network latency and throughput, while it must handle overhead introduced by the TCP/IP stack.
As a widely‑used data‑exchange protocol in industrial automation control systems, Modbus TCP enables communication among different control systems over TCP/IP networks. Several key factors make Modbus TCP vital for industrial automation:
Data exchange between devices Modbus TCP realizes data exchange among sensors, actuators and other industrial automation components. This capability is essential for integrated automation control systems.
Remote access and control Built upon TCP/IP, Modbus TCP supports remote access and control over the Internet. Operators can monitor and control industrial equipment from anywhere, improving operational flexibility.
Integration with other communication protocols Its open design allows Modbus TCP to integrate with other protocols such as HTTP, FTP or MQTT. Such flexibility supports deployment in diversified system and device environments.
Real‑time data communication For applications requiring real‑time monitoring and control, Modbus TCP provides real‑time data communication. Real‑time data transmission is critical for precise and timely control in energy management, environmental monitoring and other domains.
- Modbus TCP Frame
A Modbus TCP frame is split into two parts: MBAP and PDU.
Field composition and functions of MBAP and PDU
MBAP (Modbus Application Protocol Header) Message header used to locate Modbus requests or responses on TCP/IP networks and ensure correct data delivery to target devices. MBAP has a fixed length of 7 bytes.
PDU (Protocol Data Unit) The core component of Modbus protocol carrying actual transmitted data. The PDU contains two sub‑parts.
Function Code One‑byte value defining data type or the operation to execute, for example register read‑write operations.
Data Variable‑length payload whose size depends on the executed function.
- Modbus TCP Frame Function Codes
Function codes inside Modbus TCP frames specify operations to perform. Below are common function codes and descriptions.
According to specific Modbus application requirements, master‑station devices such as PLC and HMI send requests with corresponding function codes to slave‑station devices. Slave stations execute operations defined by function codes and return response data. These function codes grant Modbus TCP rich data‑access and control capabilities.