background image

       MODBUS TCP PROTOCOL DESCRIPTION     4-1 

4.0  MODBUS TCP PROTOCAL 

DESCRIPTION 

 

This section describes the general form of 

encapsulation of Modbus request and response when 
carried on the Ethernet network.  It is important to 

note that the structure of the request and response 

body, from the slave address to the end of the data 

portion, have exactly the same way out and meaning 

as in the other Modbus variants.  

 
 
 

4.1  Ethernet Frame 

 

 

 

 

 

 
 

Figure 4.1  Ethernet Frame 

 
 

 

The above figure shows an Ethernet frame.  The 

message framing is encapsulated into the application 

data of the Ethernet frame. 

 
 

4.2  Modbus TCP Message Framing  

 

 

 

TRANSACTION 

IDENTIFIER 

PROTOCOL 

IDENTIFIER 

LENGTH 

FIELD

 

 

SLAVE ADDRESS 

UNIT  

IDENTIFIER

FUNCTION 

DATA 

2x8 BITS 

16 BITS 

2x8 BITS 

16 BITS

2x8 BITS 

16 BITS 

 8 

BITS 8 BITS 

NX8BITS 

 

 
 

 

 

 

 

 
 

 

 

 

Figure 4.2  Encapsulation of Modbus RTU Frame in 

Ethernet Frame as Modbus TCP 

 

 

 
 

 

 

 

 

The Modbus RTU frame request and responses as 

Modbus TCP message framing is inserted into 

application data location.  The Modbus RTU message 

frame start, stop, and cRC are not included into the 
Modbus TCP frame.  A Modbus TCP  header is added 

and the slave address is replaced by a unit identifier.  

The unit identifier is considered part of the header. 

 

4.3  Modbus TCP Header Description 

 

The Modbus TCP Header contains the following 

fields: 

 

Fields 

Length Description 

Client 

Server 

Contents 

Byte 0 

U s u a l l y

Transaction 
Identifier 

2 Bytes 

Identification of a MODBUS 
Request / Response 
transaction 

Initialized by 
the client 

Recopied by the 
server from the 
received request 

Byte 1 

U s u a l l y

Byte 2

Protocol 
Identifier 

2 Bytes  0 = MODBUS protocol 

Initialized by 
the client 

Recopied by the 
server from the 
received request 

Byte 3

Byte 4

Length 

2 Bytes  Number of following bytes 

Initialized by 
the client 
(request) 

Initialized by the 
server 
(Response) 

Byte 5

N u m b e r

of Bytes

Unit 
Identifier 

1 Byte 

Identification of a remote 
slave connected on a serial 
line or on other buses 

Initialized by 
the client 

Recopied by the 
server from the 
received request 

 

 

The header is 6 bytes long: 

 

 

Transaction Identifier – It is used for 
transaction pairing, the Modbus server copies in 

the response the transaction identifier of the 
request. 

 

Protocol Identifier – It is used for intra-system 
multiplexing.  The Modbus protocol is identified 

by the value 0. 

 

 

Length – The length field is a byte count of the 
Unit Identifier, Function Code, and Data Fields. 

 

Unit Identifier – This field is used for intra-
system routing purpose.  It is typically used to 
communicate to a Modbus serial line slave 

through a gateway between an Ethernet TCP/IP 

network and a Modbus serial line.  This field is 

set by the Modbus Client in the request and must 

be returned with the same value in the response 

by the server. 

 

All Modbus/TCP Message Frames are sent via TCP on 

registered port 502. 

 

 

 
 

 

 

 

 
 

 

 

Ethernet 

header 

IP 

header 

TCP 

header 

application data 

Ethernet

trailer 

20 

20 

14 

Ethernet Frame 

46 to 1500 bytes 

MODBUS TCP HEADER 

MODBUS RTU FRAME 

Ethernet 

header 

IP 

header 

TCP 

header 

application data 

Ethernet

trailer 

Ethernet Frame 

14 

20 

20 

4

46 to 1500 bytes 

Содержание DS Series

Страница 1: ...PHOENIX AC DRIVE DX EX DS ES 3 TO 3500 HP MODBUS RTU PROTOCOL MODBUS TCP PROTOCOL MODBUS USD PROTOCOL MODBUS PROTOCOL ...

Страница 2: ...4 2 CRC Checking 3 5 4 0 MODBUS TCP PROTOCOL DESCRIPTIONS 4 1 4 1 Ethernet Frame 4 1 4 2 Modbus TCP Message Framing 4 1 4 3 Modbus TCP Header Description 4 1 4 4 Ethernet TCP Message Framing 4 2 5 0 MODBUS FUNCTION FORMATS 5 1 5 1 Field Contents in Modbus Messages 5 1 5 2 Function Codes 5 1 6 0 PHOENIX AC DRIVE FUNCTION 6 1 FORMATS 6 1 MODBUS USD Function Formats 6 1 6 2 MODBUS RTU Function Format...

Страница 3: ...ed RS 422 485 Board 2 6 2 7 Installation of Removable USB RS 485 Isolated Communications Interface 2 7 4 1 Ethernet Frame 4 1 4 2 Encapsulation of Modbus RTU Frame 4 1 4 3 Encapsulation of Modbus RTU Frame In Ethernet Frame 4 2 APPENDIX FIGURES TITLE PAGE A 1 The Four Layers of the TCP IP Protocol Suite A 1 A 2 Two Hosts on a LAN Running TCP A 2 A 3 Various Protocols at Different Layers In the TCP...

Страница 4: ...ncy Check protection in both directions The Phoenix drive defaults to 9600 Baud Rate No Parity 8 Bit Data and 2 Stop Bits Using an RS 485 serial interconnect up to 32 drives can be party lined to permit the host computer to setup and query any one of them With using the Ethernet Communications Card any host computer on a network can communicate to the Phoenix AC Drives The PHOENIX AC drive contain...

Страница 5: ...1 2 INTRODUCTION END OF INTRODUCTION SECTION ...

Страница 6: ...works at full duplex and is illustrated in Figure 2 2 2 3 RS 232 Operation The PHOENIX drive permits a direct RS 232 interface It is felt however that the differential transmission scheme offered by the RS 422 485 standard is much more suitable for an industrial environment Direct connection to a PC using the RS 232 scheme is not recommended for drives operating on the factory floor Those users th...

Страница 7: ... 100 mbps The word Ethernet refers to hardware called out in IEEE specification 802 3 and has become an increasingly popular medium for communication in industrial environments The protocols are implementation of TCP and UDP transport used with Ethernet hardware This allows many different applications to run over the same network and the same cables Thus webservers and email run on the same physic...

Страница 8: ...HARDWARE INTERFACE 2 3 Figure 2 3 Figure 2 2 Figure 2 1 ...

Страница 9: ...2 4 HARDWARE INTERFACE Isolated Communication Card 3000 4135 1 Installation of Isolated RS 422 485 Board with Control Board 3000 4100 3000 4130 Figure 2 4 ...

Страница 10: ...vable USB RS 485 Isolated Communications Interface with Cable P N 3000 4226 USB Installation of Removable USB RS 485 Isolated Communications Interface with Cable P N 3000 4226 USB with Control Board 3000 4100 3000 4130 Figure 2 5 ...

Страница 11: ...2 6 HARDWARE INTERFACE Isolated Communication Card 3000 4135 Installation of Isolated RS 422 485 Board with Control Board 3000 4101 3000 4131 Figure 2 6 ...

Страница 12: ...vable USB RS 485 Isolated Communications Interface with Cable P N 3000 4226 USB Installation of Removable USB RS 485 Isolated Communications Interface with Cable P N 3000 4226 USB with Control Board 3000 4101 3000 4131 Figure 2 7 ...

Страница 13: ...2 8 HARDWARE INTERFACE END OF HARDWARE INTERFACE ...

Страница 14: ...g the action taken any data to be returned and an error checking field If an error occurred in receipt of the message or if the slave is unable to perform the requested action the slave will construct an error message and send it as its response 3 1 2 The Query Response Cycle Master Slave Query Response Cycle The Query The function code in the query tells the addressed slave device what kind of ac...

Страница 15: ...ce into a frame that has a known beginning and ending point This allows receiving devices to begin at the start of the message read the address portion and determine which device is addressed or all devices if the message is broadcast and to know when the message is completed Partial messages can be detected and errors can be set as a result 3 3 1 RTU Framing In RTU mode messages start with a sile...

Страница 16: ...code field tells the slave what kind of action to perform Examples are to read the ON OFF states of a group of discrete coils or inputs to read the data contents of a group of registers to read the diagnostic status of the slave to write to designated coils or registers or to allow loading recording or verifying the program within the slave When the slave responds to the master it uses the functio...

Страница 17: ... message Both the character check and message frame check are generated in the master device and applied to the message content before transmission The slave checks each character and the entire message frame during receipt The master is configured by the used to wait for a predetermined timeout interval before aborting the transaction This interval is set to be long enough for any slave to respon...

Страница 18: ...ess begins of applying successive eight bits bytes of the message to the current contents of the register Only the eight bits of data in each character are used for generating the CRC Start and stop bits and the parity bit do not apply to the CRC During generation of the CRC each eight bit character is exclusive ORed with the register contents Then the result is shifted in the direction of the lea...

Страница 19: ...3 6 MODBUS RTV PROTOCAL DESCRIPTION END OF MODBUS RTU PROTOCAL DESCRIPTION ...

Страница 20: ...st Response transaction Initialized by the client Recopied by the server from the received request Byte 1 Usually 0 Byte 2 0 Protocol Identifier 2 Bytes 0 MODBUS protocol Initialized by the client Recopied by the server from the received request Byte 3 0 Byte 4 0 Length 2 Bytes Number of following bytes Initialized by the client request Initialized by the server Response Byte 5 Number of Bytes Uni...

Страница 21: ...odbus RTU message frame start and stop is not included into the Ethernet TCP frame The format is as shown SLAVE ADDRESS FUNCTION D A T A CRC CHECK 8 BITS 8 BITS NX8BITS 2x8 BITS 16 BITS Figure 4 3 Encapsulation of Modbus RTU frame in Ethernet frame as Ethernet TCP Ethernet header IP header TCP header application data Ethernet trailer 14 20 20 4 Ethernet Frame 46 to 1500 bytes Modbus RTU Frame ...

Страница 22: ...011 Error Check Trailer CRC 16 bits None Total Bytes 11 The master query is a Read Holding Registers request to slave device address 06 The message requests data from three holding registers 40108 40110 Note The message specifies the starting register address as 0107 006B hex The slave response echoes the function code indicating this is a normal response The Byte Count field specifies how many ei...

Страница 23: ...5 2 MODBUS FUNCTION FORMATS END OF MODBUS FUNCTION FORMATS ...

Страница 24: ...me for value of 1 The response is 9600 BAUD Function Code 03 Read Parameter Value This function reads the data value and decimal point position of the specified parameter on the Phoenix drive Broadcast is not supported Query Modbus Format Phoenix Format Example Slave Address Drive Address 01 Function Code Function Code 03 Starting Address Hi Menu Number 05 Starting Address Lo Parameter Number 09 N...

Страница 25: ... Hi CRC Hi C4 Response Modbus Format Phoenix Format Example Slave Address Drive Address 01 Function Code Function Code 04 Byte Count Byte Count 10 Data 1 Hi Parameter Name Char 1 42 Data 1 Lo Parameter Name Char 2 41 Data 2 Hi Parameter Name Char 3 53 Data 2 Lo Parameter Name Char 4 45 Data 3 Hi Parameter Name Char 5 20 Data 3 Lo Parameter Name Char 6 4D Data 4 Hi Parameter Name Char 7 4F Data 4 L...

Страница 26: ...ed on DS ES and LS series only 6 2 Modbus RTU Function Formats The Phoenix AC drive supports three Modbus functions The drive Modbus write function supports only one parameter per query The drive Modbus read function supports multiple parameters per query A query s a non existing function the response will be an error Code Modbus Function Phoenix Function 03 Read Multiple Register Read Parameter V...

Страница 27: ...eter M05P09 Function Code 16 Write Parameter Value This function writes the data value to the specified parameter of the Phoenix Drive Broadcast is supported Query Modbus Format Phoenix Format Example Slave Address Drive Address 01 Function Code Function Code 10 Starting Address Hi Menu Number 05 Starting Address Lo Parameter Number 09 Number of Register Hi Number of Parameters Hi 00 Number of Reg...

Страница 28: ... data value and decimal point position of the specified parameter on the Phoenix drive Broadcast is not supported Query Phoenix Format Example Drive Address 01 Function Code 43 Menu Number 05 Parameter Number 09 Don t Care 00 Don t Care 00 CRC Lo 94 CRC Hi CB Response Phoenix Format Example Drive Address 01 Function Code 43 Byte Count 03 Parameter Value Hi 02 Parameter Value Lo 58 Decimal Point Lo...

Страница 29: ...6 6 PHOENIX AC DRIVE FUNCTION FORMATS END OF PHOENIX AC DRIVE FUNCTION FORMATS ...

Страница 30: ...ception code Data Field In a normal response the slave may return data or statistics in the data field any information that was requested in the query In an exception response the slave returns an exception code in the data field This defines the slave condition that caused the exception Here is an example of a master query and slave exception response The field examples are shown in hexadecimal Q...

Страница 31: ...7 2 EXCEPTION RESPONSE END OF EXCEPTION RESPONSE ...

Страница 32: ... register putting the result in the CRC register Step 3 Shift the CRC register on bit to the right toward the LSB zerofilling the MSB Extract and examine the LSB Step 4 If the LSB is 0 repeat Step 3 another shift If the LSB is 1 Exclusive OR the CRC register with the polynomial value A001 hex 1010 0000 0000 0001 Step 5 Repeat Steps 3 and 4 until eight shifts have been performed When this is done a...

Страница 33: ...d short CRC16 puchMsg usDataLen unsigned char puchMsg message to calculate CRC upon unsigned short usDataLen quantity of bytes in message unsigned char uchCRCHi 0xFF high CRC byte initialized unsigned char uchCRCLo 0xFF low CRC byte initialized unsigned uIndex will index into CRC lookup while usDataLen pass through message buffer uIndex uchCRCHi puchMsg calculate the CRC uchCRCHi uchCRCLo auchCRCH...

Страница 34: ...0 0xC1 0x81 0x40 0x01 0xC0 0x80 0x41 0x01 0xC0 0x80 0x41 0x00 0xC1 0x81 0x40 0x01 0xC0 0x80 0x41 0x00 0xC1 0x81 0x40 0x00 0xC1 0x81 0x40 0x01 0xC0 0x80 0x41 0x01 0xC0 0x80 0x41 0x00 0xC1 0x81 0x40 0x00 0xC1 0x81 0x40 0x01 0xC0 0x80 0x41 0x00 0xC1 0x81 0x40 0x01 0xC0 0x80 0x41 0x01 0xc0 0x80 0x41 0x00 0xC1 0x81 0x40 0x00 0xC1 0x81 0x40 0x01 0xC0 0x80 0x41 0x01 0xC0 0x80 0x41 0x00 0xC1 0x81 0x40 0x0...

Страница 35: ... 0xE8 0xE9 0x29 0xEB 0x2B 0x2A 0xEA 0xEE 0x2E 0x2F 0xEF 0x2D 0xED 0xEC 0x2C 0xE4 0x24 0x25 0xE5 0x27 0xE7 0xE6 0x26 0x22 0xE2 0xE3 0x23 0xE1 0x21 0x20 0xE0 0xA0 0x60 0x61 0xA1 0x63 0xA3 0xA2 0x62 0x66 0xA6 0xA7 0x67 0xA5 0x65 0x64 0xA4 0x6C 0xAC 0xAD 0x6D 0xAF 0x6F 0x6E 0xAE 0xAA 0x6A 0x6B 0xAB 0x69 0xA9 0xA8 0x68 0x78 0xB8 0xB9 0x79 0xBB 0x7B 0x7A 0xBA 0xBE 0x7E 0x7F 0xBF 0x7D 0xBD 0xBC 0x7C 0xB4...

Страница 36: ...number 5 decimal is converted into a one byte two digit representation 05 hexadecimal Modbus Format Phoenix Format Example Register Address Hi Menu Number 0C Register Address Lo Parameter Number 05 9 2 Parameter to Register Address Conversion The US Drives Phoenix two digit Menu number and Parameter number sometimes needs to be converted to a register address in third party software programs The c...

Страница 37: ...9 2 PARAMETER CONVERSION END OF PARAMETER CONVERSION ...

Страница 38: ...he link layer sometimes called the data link layer or network interface layer normally includes the device driver in the operating system and the corresponding network interface cad in the computer Together they handle all the hardware details of physically interfacing with the cable or whatever type of media is being used 2 The network layer sometimes called the internet layer handles the movemen...

Страница 39: ... TCP IP TCP and IP are only two of the protocols An alternative name is the Internet Protocol Suite The purpose of the network interface layer and the application layer are obvious the former handles the details of the communication media Ethernet ring etc while the latter handles one specific user application FTP Telnet etc This figure shows some layers and protocols in the TCP IP protocol suite ...

Страница 40: ... netmask is 255 255 255 0 2 5 Subnet Address All hosts are required to support subnet addressing While the IP address classes are the convention IP addresses are typically subnetted to smaller address sets that do not match the class system The suffix bits are divided into a subnet ID and a host ID This makes sense for class A and B networks since no one attaches as many hosts to these networks as...

Страница 41: ...ific and unique place in the domain name space DNS makes it possible for us to use identifiers such as zworld com to refer to an IP address on the Internet Name servers contain information on some segment of the DNS and make that information available to clients who are called resolvers 6 0 ETHERNET FRAME 6 1 Ethernet Frame The term Ethernet generally refers to a standard published in 1982 by Digi...

Страница 42: ...te the layer to which the data belongs IP handles this by storing an 8 bit value in its header called the protocol field A value of 1 is for ICMP 2 is for IGMP 6 indicates TCP and 17 is for UDP Similarly many different applications can be using TCP or UDP at any one time The transport layer protocols store an identifier in the headers they generate to identify the application Both TCP and UDP use ...

Страница 43: ...A 6 APPENDIX BASIC TCP IP DESCRIPTION THIS PAGE INTENTIONALLY LEFT BLANK ...

Страница 44: ...R DESIGN EXPERTS US Drives Inc 2221 Niagara Falls Boulevard P O Box 281 Niagara Falls NY 14304 0281 Tel 716 731 1606 Fax 716 731 1524 Visit us at www usdrivesinc com Products Designed And Manufactured In The United States Of America MODP0917 Printed in U S A ...

Отзывы: