n
- 52 -
Leading 6 bytes of Modbus/TCP protocol:
Byte 00
Byte 01
Byte 02
Byte 03
Byte 04
Byte 05
Transaction identifier
Protocol identifier
Length field
(upper byte )
Length field
(lower byte)
Transaction identifier:
Assigned by Modbus/TCP master (client)
Protocol identifier:
0
Length field (upper byte):
0 (since all messages are smaller than 256)
Length field (lower byte):
Number of following RTU data bytes
RTU Data Structure
Byte 06
Byte 07
Byte 08-09
Byte 10-11
Net ID
(Station number)
Function Code
Data Field
Reference number
(Address Mapping)
Number of points
Net ID (Station Number):
specifies the address of the receiver (Modbus/TCP slave).
The first byte in the message structure of Modbus is the receiver’s address. The valid
addresses are in the range of 0 to 247. Addresses 0 is used for broadcast, while addresses 1
to 247 are given to individual Modbus devices.
Function Code:
specifies the message type.
The second byte in the frame structure of the Modbus RTU is the function code. The function
code describes what the slave is required to do. Valid function codes are between 1 and 255.
The slave uses the same function code as the request to answer it. Only when an error occurs
in the system will the highest bit of the function code is set to ‘1’. Hence the master will know
whether the message has been transmitted correctly or not.
