Data Sheet

• Modbus over TCP/IP or Modbus over TCP or Modbus RTU/IP: This is a Modbus variant that differs

from Modbus TCP in that a checksum is included in the payload as with Modbus RTU.

Data model and function calls are identical for the previous 4 variants of protocols; only the encapsulation

is different.

1.4 Communication and devices

Each device intended to communicate using Modbus is given a unique address. On Ethernet, any device

can send out a Modbus command, although usually only one master device does so. A Modbus command

contains the Modbus address of the device it is intended for (1 to 247). Only the intended device will act on

the command, even though other devices might receive it (an exception is specific broadcast commands

sent to node 0, which are acted on but not acknowledged). All Modbus commands contain checksum

information, to allow the recipient to detect transmission errors. The basic Modbus commands can instruct

an RTU to change the value in one of its registers, control or read an I/O port, and command the device to

send back one or more values contained in its registers.

There are many modems and gateways that support Modbus, as it is a very simple protocol and often

copied. Some of them were specifically designed for this protocol. Different implementations use wireline,

wireless communication, such as in the ISM band, and even Short Message Service (SMS) or General Packet

Radio Service (GPRS). One of the more common designs of wireless networks makes use of mesh

networking. Typical problems that designers have to overcome include high latency and timing issues.

1.5 Frame format

A Modbus frame is composed of an Application Data Unit (ADU), which encloses a Protocol Data Unit

(PDU):

• ADU = Address + PDU + Error check,

• PDU = Function code + Data.

Note:

The byte order for values in Modbus data frames is big-endian (MSB, most significant byte of a value

received first).

All Modbus variants choose one of the following frame formats:

1.5.1 Modbus RTU frame format

Name

Length (bytes)

Description

Address

Node address

Function

Function code

Data

n is the number of data bytes, it depends on function

CRC

Cyclic redundancy check (CRC-16-IBM)

Example of frame in hexadecimal: 01 04 02 FF FF B8 80 (CRC-16-ANSI calculation from 01 to FF gives 80B8,

which is transmitted least significant byte first).