Modbus is a communication protocol that has long been widely used for exchanging data between industrial devices. Modbus TCP is the version of this protocol carried over Ethernet and TCP/IP. Because of its simple structure, its openness, and the fact that it is supported by nearly every brand of device, it is frequently used in projects where equipment from different manufacturers must be brought together.
Basic logic: client and server
Modbus is based on a request/response principle. One side asks a question, the other side answers. There is no spontaneous data transmission.
- Client (formerly master): The side that initiates the request.
- Server (formerly slave): The side that answers the request. A drive,
Usually a PLC, SCADA, or HMI.
power analyzer, temperature controller, or remote I/O.
In Modbus TCP a client can connect to several servers at the same time; a server can also accept several clients. This is an important flexibility compared to RTU, which works over a serial line.
Data model: four tables
Modbus keeps data in four separate areas:
| Area | Type | Access | Size | |—|—|—|—| | Coil | Bit | Read / Write | 1 bit | | Discrete Input | Bit | Read only | 1 bit | | Input Register | Word | Read only | 16 bit | | Holding Register | Word | Read / Write | 16 bit |
In practice the holding register is used the most. Drive parameters, speed reference, and measurement values are generally kept in this area.
Common function codes
| Code | Operation | |—|—| | 01 | Read coil | | 02 | Read discrete input | | 03 | Read holding register | | 04 | Read input register | | 05 | Write single coil | | 06 | Write single holding register | | 15 | Write multiple coils | | 16 | Write multiple holding registers |
Which function codes a device supports is stated in its own documentation; not all devices support all codes.
Difference between Modbus TCP and Modbus RTU
| Topic | Modbus RTU | Modbus TCP | |—|—|—| | Physical layer | RS-485 / RS-232 serial line | Ethernet | | Topology | Bus, with termination resistors | Ethernet network, switched | | Addressing | 1-byte slave address | IP address + unit id | | Error checking | CRC | TCP’s own checking | | Concurrency | Single master | Multi-client | | Message header | None | MBAP header (transaction, protocol, length, unit) |
Modbus TCP has no CRC field; data integrity is provided by the TCP layer. In addition to the message, an MBAP header is prepended. The *unit identifier* field in this header is used to select the serial-line device behind the interface, especially in systems using a gateway.
The standard Modbus TCP port is 502.
Addressing confusion — the most common mistake
Two different address notations are in circulation in Modbus, and this is the issue that costs the most time during commissioning.
Protocol address: Starts at 0. It is the actual value sent on the wire.
Conventional (5-digit) notation: Starts at 1 and carries the area type as a prefix. Holding registers are shown in the 4xxxx block.
That is, a register shown as “40001” in the documentation is protocol address 0 on the wire. If a device’s documentation uses the conventional notation while the library on the PLC side uses the protocol address, an address offset occurs. If unexpected values are being read during commissioning, this is the first place to check.
32-bit data and byte order
A Modbus register is 16 bits. A 32-bit value (a long integer or a floating-point number) is carried by splitting it across two registers. Two questions arise here:
- Which register comes first — the high word or the low word?
- What is the byte order within the register?
Because the standard does not impose a strict requirement on this, manufacturers use different implementations. The result: the value is read but comes out meaningless. The solution is to check the word/byte order in the device documentation and, if necessary, perform a word swap on the PLC side.
Similarly, measurement values are often carried as scaled integers (for example ten times the real value). The scaling factor is again in the device documentation.
Performance and query design
In Modbus TCP every query means one round trip. Instead of making many single-register queries, reading consecutive registers together in a single query improves performance noticeably. For this reason it is preferable that the data to be read on the device be adjacent in address.
When designing the query loop, the timeout and retry counts should be chosen realistically. Too short a timeout produces unnecessary fault alarms; too long a timeout slows down the entire scan cycle when a device fails.
Limitations
Modbus TCP is not a real-time protocol. The response time depends on network traffic, the processing load of the device, and the TCP stack; it is not guaranteed. For this reason it is not suitable for synchronized motion, fast safety functions, and short-cycle control loops. For such needs, real-time protocols such as EtherCAT or Profinet IRT are used.
In addition, the protocol has no authentication or encryption. Modbus TCP devices should not be directly exposed to the corporate network or the internet; the automation network should be kept separate.
Where it is preferred
- Systems where devices from different brands must be brought together
- Reading measurement devices such as power analyzers, meters, and temperature
- Monitoring the speed reference and status information of drives
- Transferring data to the SCADA and reporting layer
- Bringing existing Modbus RTU devices onto the Ethernet network via a gateway
controllers
Related product families: PLC, HMI, AC Drive, Gateway, Ethernet Switch, Communication Modules
Leave a Reply