MODBUS MESSAGING ON TCP/IP …

1 MODBUS -IDAJune 4, 2004 MESSAGING ON TCP/IP implementation .. / SERVER DOCUMENTS .. 32 ABBREVIATIONS .. 33 CONTEXT .. DESCRIPTION .. communication architecture .. On TCP/IP Application Data Unit .. Header description .. FUNCTIONS CODES DESCRIPTION .. 64 FUNCTIONAL COMPONENT ARCHITECTURE CONNECTION MANAGEMENT .. management of Operating Modes on the TCP Control Module .. of TCP/IP STACK .. of BSD Socket interface .. layer layer parameterization .. APPLICATION LAYER .. Server ..265 implementation GUIDELINE .. MODEL DIAGRAM .. management package .. layer layer CLASS AND METHODS DESCRIPTION .. Server Class .. Client Classes .. Management MESSAGING on TCP/IP implementation guide 4, 2004 OBJECTIVESThe objective of this document is to present the MODBUS MESSAGING service overTCP/IP , in order to provide reference information that helps software developers toimplement this service.

2 The encoding of the MODBUS function codes is not describedin this document, for this information please read the MODBUS Application ProtocolSpecification [1].This document gives accurate and comprehensive description of a MODBUS messagingservice implementation . Its purpose is to facilitate the interoperability between thedevices using the MODBUS MESSAGING document comprises mainly three parts: An overview of the MODBUS over TCP/IP protocol A functional description of a MODBUS client, server and gatewayimplementation. An implementation guideline that proposes the object model of an MODBUS implementation CLIENT / SERVER MODELThe MODBUS MESSAGING service provides a Client/Server communication betweendevices connected on an Ethernet TCP/IP client / server model is based on four type of messages.

3 MODBUS Request, MODBUS Confirmation, MODBUS Indication, MODBUS ResponseMODBUS ClientMODBUS ServerRequestIndicationResponseConfirmat ionA MODBUS Request is the message sent on the network by the Client to initiate atransaction,A MODBUS Indication is the Request message received on the Server side,A MODBUS Response is the Response message sent by the Server,A MODBUS Confirmation is the Response Message received on the Client sideThe MODBUS MESSAGING services (Client / Server Model) are used for real timeinformation exchange: between two device applications, between device application and other device, between HMI/SCADA applications and devices, between a PC and a device program providing on line MESSAGING on TCP/IP implementation guide 4, 2004 REFERENCE DOCUMENTSThis section gives a list of documents that are interesting to read before this one.

4 [1] MODBUS Application Protocol Specification [2]RFC 1122 Requirements for Internet Hosts -- Communication Layers2 ABBREVIATIONSADUA pplication Data UnitIETFI nternet Engineering Task ForceIPInternet ProtocolMACM edium Access ControlMBMODBUSMBAPMODBUS Application ProtocolPDUP rotocol Data UnitPLCP rogrammable Logic ControllerTCPT ransport Control ProtocolBSD Berkeley Software DistributionMSLM aximum Segment Lifetime3 PROTOCOL General communication architectureA communicating system over MODBUS TCP/IP may include different types of device: A MODBUS TCP/IP Client and Server devices connected to a TCP/IP network The Interconnection devices like bridge, router or gateway for interconnectionbetween the TCP/IP network and a serial line sub-network which permitconnections of MODBUS Serial line Client and Server end MESSAGING on TCP/IP implementation guide 4, 2004 1: MODBUS TCP/IP communication architectureThe MODBUS protocol defines a simple Protocol Data Unit (PDU) independent of theunderlying communication layers.

5 The mapping of MODBUS protocol on specific busesor networks can introduce some additional fields on the Application Data Unit (ADU).Additional addressFunction codeDataError checkADUPDUF igure 2: General MODBUS frameThe client that initiates a MODBUS transaction builds the MODBUS Application DataUnit. The function code indicates to the server which kind of action to MODBUS On TCP/IP Application Data UnitThis section describes the encapsulation of a MODBUS request or response when it iscarried on a MODBUS TCP/IP codeDataMBAP HeaderPDUMODBUS TCP/IP ADUF igure 3: MODBUS request/response over TCP/IPA dedicated header is used on TCP/IP to identify the MODBUS Application Data Unit. Itis called the MBAP header ( MODBUS Application Protocol header).

6 MODBUS ClientTCP/IPMODBUS ServerTCP/IPMODBUS ServerTCP/IPMODBUSS erverSerial LineMODBUSS erverSerial LineMODBUSC lientSerial LineMODBUS ClientTCP/IPMODBUSC lientTCP/IPServer TCP/IPgatewayMODBUS SerialMODBUS MESSAGING on TCP/IP implementation guide 4, 2004 header provides some differences compared to the MODBUS RTU application dataunit used on serial line: The MODBUS slave address field usually used on MODBUS Serial Line isreplaced by a single byte Unit Identifier within the MBAP Header. The Unit Identifier is used to communicate via devices such as bridges,routers and gateways that use a single IP address to support multipleindependent MODBUS end units. All MODBUS requests and responses are designed in such a way that therecipient can verify that a message is finished.

7 For function codes wherethe MODBUS PDU has a fixed length, the function code alone is function codes carrying a variable amount of data in the request orresponse, the data field includes a byte count. When MODBUS is carried over TCP, additional length information iscarried in the MBAP header to allow the recipient to recognize messageboundaries even if the message has been split into multiple packets fortransmission. The existence of explicit and implicit length rules, and use ofa CRC-32 error check code (on Ethernet) results in an infinitesimal chanceof undetected corruption to a request or response MBAP Header descriptionThe MBAP Header contains the following fields:FieldsLengthDescription -ClientServerTransactionIdentifier2 Bytes Identification of aMODBUS Request /Response by theclientRecopied by theserver from thereceivedrequestProtocol Identifier2 Bytes 0 = MODBUS protocolInitialized by theclientRecopied by theserver from thereceivedrequestLength2 Bytes Number of followingbytesInitialized by theclient ( request)Initialized bythe server (Response)Unit Identifier1 ByteIdentification of aremote slaveconnected on a serialline or on other by theclientRecopied by theserver from thereceivedrequestThe header is 7 bytes long: Transaction Identifier - It is used for transaction pairing, the MODBUS server copiesin the response the transaction identifier of the request.

8 Protocol Identifier It is used for intra-system multiplexing. The MODBUS protocolis identified by the value 0. Length - The length field is a byte count of the following fields, including the UnitIdentifier and data MESSAGING on TCP/IP implementation guide 4, 2004 Unit Identifier This field is used for intra-system routing purpose. It is typicallyused to communicate to a MODBUS or a MODBUS + serial line slave through agateway between an Ethernet TCP-IP network and a MODBUS serial line. This field isset by the MODBUS Client in the request and must be returned with the same value inthe response by the MODBUS /TCP ADU are sent via TCP on registered port : the different fields are encoded in MODBUS FUNCTIONS CODES DESCRIPTIONS tandard function codes used on MODBUS application layer protocol are described indetails in the MODBUS Application Protocol Specification [1].

9 MODBUS MESSAGING on TCP/IP implementation guide 4, 2004 FUNCTIONAL DESCRIPTIONThe MODBUS Component Architecture presented here is a general model includingboth MODBUS Client and Server Components and usable on any devices may only provide the server or the client the first part of this section a brief overview of the MODBUS MESSAGING servicecomponent architecture is given, followed by a description of each componentpresented in the architectural MODBUS COMPONENT ARCHITECTURE MODELUSERAPPLICATIONC ommunicationApplicationLayerModbus ClientModbus ServerModbus ClientInterfaceTCPM anagementConnection ManagementAccess CtlTCP/IP StackStackparmeterizationModbus BackendInterfaceRessource Management&Flow ControlFigure 4: MODBUS MESSAGING Service Conceptual Architecture Communication Application Layer A MODBUS device may provide a client and/or a server MODBUS interface.

10 A MODBUS backend interface can be provided allowing indirectly the access to userapplication objects. Four areas can compose this interface: input discrete, output discrete (coils), inputregisters and output registers. A pre-mapping between this interface and the userapplication data has to be done (local issue). MODBUS MESSAGING on TCP/IP implementation guide 4, 2004 tablesObject typeType ofComments Discretes InputSingle bitRead-OnlyThis type of data can be provided by an I/O bitRead-WriteThis type of data can be alterable by an Registers16-bit wordRead-OnlyThis type of data can be provided by an I/O systemHolding Registers16-bit wordRead-WriteThis type of data can be alterable by an applicationprogram.