Modbus message format | Modbus frame structure

This page covers Modbus message format or Modbus frame structure. The Modbus message format has ASCII mode and RTU mode.

There are many protocols for industrial automation and metering. The Modbus protocol is based on query/response model.

Modbus term is a trademark of Modicon Inc. which maintains the standard. It is a application layer protocol which is based on client/server architecture between the devices connected on different types of buses or networks. Modbus protocol runs on top of RS232, RS422 and RS485. There is a specification for Modbus/TCP defined for IP based link layer for Modbus frames.
Refer What is Modbus Protocol➤➤.

Modbus message format,Modbus frame structure

The figure-1 depicts Modbus message format. As shown Modbus protocol works on master-slave model. One device on the bus or network can initiate transactions (referred as queries) which can address individual slave devices or broadcasts to all the slave devices. The slave device take action as per the Modbus frame received and respond if required in the form of "response frame".

The transmission mode defines framing and bit encoding of the messages to be transmitted on the Modbus network. Modbus frame structure are of two types viz. ASCII mode and RTU mode.

Modbus Frame Structure-ASCII Mode

The figure-2 depicts ASCII mode of Modbus frame. As shown in ASCII mode, each byte is encoded on serial link as 2 ASCII characters. Each ASCII character is transmitted as 1 start bit, 7 data bits, zero or 1 parity bit, one or two stop bits.

Modbus frame Structure in ASCII mode=
{
Start byte ( 0x3A )
Device Address ( 2 bytes) , Function code( 2 bytes), Query Data (variable), ErrorCheck (2 bytes)
2 End Bytes ( 0x0D0A )
}

Modbus Frame Structure-RTU Mode

The figure-3 depicts RTU mode of Modbus frame. As shown in RTU (Remote terminal unit) mode, the message is transmitted in a continuous stream format. Each 8 bit byte is framed by 1 start bit, 8 data bits, 0 or 1 parity bit, 1 or 2 stop bits. The message itself starts after a silent period of at least 3.5 character times.

Let us understand the different fields of Modbus frame structure.

Modbus Address: Modbus message starts with 8 bit target address. This can take any value from 0 to 247. Here 0 is used as broadcast address and rest are used as unique device addresses.

Modbus Functions: The function code contains 2 characters (in ASCII mode) and 8 bits (in RTU mode)/ It takes any value from 1 to 255 and are selected as per application profile.

Modbus Data Field: This data field convey application level information as desired by different Modbus function. If function contains variable size of data, it begins with "byte count" in this position.

Modbus/TCP standard defines TCP/IP access to the Modbus protocol functionality.