Byte sequence

Modbus uses "BIG ENDIAN", i.e. in the messages the bytes with a high significance are sent first and are thus stored in the addresses of low significance.

ibaPDA swaps all received 16- and 32-bit-values to the Intel format "LITTLE ENDIAN" ("Swapping"). You can select the Swapping method in ibaPDA for data that do not come from a Modbus controller. See General module settings

Modbus RTU / Modbus TCP

In the following representation, you can see the basic structure of the Modbus protocol and the differences between Modbus RTU and Modbus TCP.

RTU

Remote Terminal Unit

MBAP

Modbus Application Protocol

ADU

Application Data Unit

PDU

Protocol Data Unit

For Modbus TCP, the MBAP Header is put in front of the function code. The Unit ID corresponds to the device address (slave ID = server ID) of the RTU protocol. The CRC code is omitted.

There is also a "Modbus RTU over TCP/IP" version. The Modbus RTU message is transmitted via TCP/IP. This version is used when using Gateways serial/Ethernet.

MBAP Header

The MBAP Header is a dedicated header used for the communication with TCP/IP to identify the Modbus Application Data. The header contains the following fields:

Fields

Bytes

Description

Transaction Identifier

2

Identification of a Modbus request/response transaction

It is used for transaction pairing. The Modbus client sends it in the request; the Modbus server copies in the response message the transaction identifier of the request.

Protocol Identifier

2

0 = Modbus protocol

It is used in multiplexing procedures. The Modbus protocol has the value 0.

Length

2

Number of following bytes

The length field is a count of the following bytes, including the Unit ID, Function Code and Data fields.

Unit Identifier

1

Addressing a remote server (device address) connected to the Modbus client

This field is sent by the Modbus client in the request and must be returned with the same value in the response by the server.
Function code

One byte contains the function code that determines which function the server has to carry out depending on the request.

The ibaPDA-Modbus-TCP-Client driver supports the functions:

  • 0x01: Read Coils

  • 0x02: Read Discrete Inputs

  • 0x03: Read Holding Registers

  • 0x04: Read Input Registers

  • 0x0F: Write Multiple Coils

  • 0x10: Write Multiple Registers
Data fields

The user data fields contain several subfields like starting address, number of registers, number of bytes and the actual data. The content of these fields depends on the used function code.