Skip to content
Start free evaluation

Modbus TCP

Modbus TCP puts a seven-byte MBAP (Modbus Application Protocol) header in front of the PDU and sends it over a TCP connection. Unlike the serial line there’s no CRC: TCP handles error detection. This page is based on sections 3.1 (protocol description), 3.1.3 (MBAP header) and 4.2 (TCP connection management) of the MODBUS Messaging on TCP/IP Implementation Guide V1.0b.

MBAP header

Section titled “MBAP header”
+-------------------+-------------------+-----------+-----------+------------------+
| transaction ID 2B | protocol ID 2B    | length 2B | unit ID 1B| PDU              |
+-------------------+-------------------+-----------+-----------+------------------+
  00 01               00 00               00 06       01          03 00 00 00 01
Field Meaning
Transaction identifier Chosen by the client and copied into the response by the server, so the client can pair responses with requests.
Protocol identifier Always 0 for Modbus.
Length Number of bytes that follow: the unit identifier plus the PDU.
Unit identifier Selects a device behind a gateway; see below.

The response to that request is 00 01 00 00 00 05 01 03 02 00 2A: transaction 1 and unit 1 come back unchanged, and the length is 5 for the unit identifier plus the four-byte response PDU.

TCP is a byte stream, so one receive can deliver part of an ADU or several ADUs back to back. The receiver uses the length field to find frame boundaries. PDComm feeds every received byte into a decoder that assembles frames, and closes the connection when the protocol identifier isn’t 0 or the length is outside 2–254.

Unit identifier

Section titled “Unit identifier”

When you address a TCP device directly, its IP address already identifies it, so the unit identifier isn’t needed. The implementation guide recommends 0xFF in that case and notes that 0 is also accepted. In front of a gateway between TCP and a serial bus, however, the unit identifier selects the device address on the serial bus.

Real devices behave in one of these ways; the device manual says which value it expects:

  • It ignores the unit identifier and answers every request.
  • It accepts only one value, usually 1 or 0xFF.
  • Like a gateway, it forwards each value to a different device.

PDComm server behavior: a PDComm TCP server is one device connected directly to TCP. It answers its configured unit (1 by default) and the direct-addressing values 0xFF and 0. On TCP, 0 isn’t a broadcast, so a response comes back. Every response carries the unit identifier of its request. Any other value, such as 2, gets exception 0A (Gateway Path Unavailable). A PDComm gateway forwards only the unit identifiers listed in routes to the serial bus and answers any other value, including 0xFF and 0, with exception 0A. A PDComm client sends its configured unit, and the unit member of a request command overrides it per request (0–255).

Ports and connections

Section titled “Ports and connections”
  • The standard Modbus TCP port is 502; Modbus/TCP Security uses 802.
  • The tutorials use 1502 and 1802 instead. They don’t clash with a real device service and don’t need administrator rights on Linux.
  • A server address with port 0, such as 127.0.0.1:0, lets the operating system pick a free port. PDComm reports the actual address in config.address of the connect response.
  • PDComm’s address is a socket address in IP:port form, such as 192.168.0.10:502 or [::1]:1502. Host names such as localhost:1502 aren’t resolved; connect fails with Invalid TCP address.

PDComm handles connections as follows:

Item Behavior
Server connections Up to 32 at a time. Additional connections are closed immediately.
Idle server connections Closed after 120 seconds without data.
Client connect connect fails when the connection isn’t established within timeout_ms.
Client requests Each request sends one request and waits for the response or timeout_ms.
Client timeouts When no response arrives within timeout_ms, the request fails with Timeout and the client closes the connection, so a late response can’t be paired with the next request. Connect again to continue.
Write retries Never automatic. After a write times out, read the value first to see whether the write took effect.

Gateways

Section titled “Gateways”

A gateway receives Modbus TCP requests, forwards them to devices on a serial bus such as RS-485, and returns the responses over TCP. The unit identifier selects the serial device.

TCP client --(unit 1)--> gateway --(address 7)--> serial device A
           --(unit 2)-->         --(address 9)--> serial device B

A serial bus carries one transaction at a time, so requests from several TCP clients queue inside the gateway. When the gateway can’t forward a request, it answers with one of two exceptions:

Exception Situation
0A Gateway Path Unavailable There’s no path for the unit identifier.
0B Gateway Target Device Failed to Respond The serial device didn’t respond in time.

A PDComm gateway maps TCP unit identifiers to serial addresses explicitly with its routes table. Try it in TCP-to-serial gateway.

Privacy Policy