Object Messaging Specification for the MODBUS/TCP Protocol
Version 1.1
November 08, 2004
© 2004 Modbus-IDA
Object Messaging Specification for the MODBUS/TCP Protocol: Version 1.1
ii
Document Version
Version 0.2 – February 12, 1999
Version 0.3 – March 2, 1999
Version 1.0 – March 21, 1999 (draft)
Version 1.0 – April 6, 1999
Version 1.1—November 08, 2004
Object Messaging Specification for the MODBUS/TCP Protocol: Version 1.1
iii
Table of Contents
EXECUTIVE SUMMARY...............................................................................................V
INTRODUCTION ...........................................................................................................1
REFERENCES ..............................................................................................................2
GLOSSARY...................................................................................................................2
DATA TRANSMISSION ................................................................................................2
NETWORK ACCESS AND ADDRESSING...................................................................5
MESSAGE STRUCTURE..............................................................................................5
OBJECT ADDRESSING PROTOCOL..........................................................................6
COMPATIBILITY OF MESSAGING WITH NON-MESSAGE CAPABLE NODES AND
NODES RETROFITTED WITH MESSAGING CAPABILITIES.....................................9
APPENDIX A:
ALTERNATE TRANSPORT MECHANISM FOR MODBUS/TCP -- UTILIZING
“EXISTING” REGISTER READ/WRITE FUNCTION CODES TO SUPPORT THE
MODBUS/TCP OBJECT MESSAGING PROTOCOL 10
BACKGROUND...........................................................................................................10
SPECIFIC ISSUES ......................................................................................................10
REGISTER ASSIGNMENT..........................................................................................11
PROTOCOL ENCAPSULATION DETAILS ................................................................11
MAILBOX DISCOVERY ..............................................................................................12
Object Messaging Specification for the MODBUS/TCP Protocol: Version 1.1
iv
CHANNEL ASSIGNMENT AND RELEASE................................................................12
PROTOCOL ENCAPSULATION.................................................................................13
PROTOCOL ENCODING EXAMPLE..........................................................................14
APPENDIX B: SERVICE RESPONSE “ERROR CODE” PARAMETER VALUES 20
APPENDIX C: EXAMPLE OF A DATA FIELD IN A MODBUS MESSAGE 21
Object Messaging Specification for the MODBUS/TCP Protocol: Version 1.1
v
Executive Summary
The message specification contains the following main elements:
� Nodes on a Modbus/TCP network must use a 2-level address structure to select a target
(‘server’) device. The first level is the conventional 32-bit IP address. The second level is a
‘Unit Identifier’ field which usually has values 0-247 to select multiple targets which share
a single network interface, such as use of network gateway products (note: that identifier
255 is generally used to address the gateway device itself). Broadcasting of messages is
handled specifically at the application level as a point to point message service to all target
devices.
� Object Messages are communicated serially in the “data” portion of the Modbus/TCP
protocol of each message transaction. This allows receiving devices to begin at the start of
the message frame, read the address portion, determine which device is addressed, and to
know when the message frame is completed.
� On the Modbus/TCP network, the underlying transport protocol handles the framing
and segmentation / re-assembly of messages including beginning and end delimiters. An
additional application layer fragmentation protocol is included to maintain compatibility
with existing applications; these applications generally support function data field lengths
of less than or equal to 197 bytes per message (fragment). This transport protocol handles
delivery to the destination device making the address field of the messaging frame
redundant for the actual transmission
� An object message contains the following fields:
Fragment Byte Count / Fragment Protocol / Object Messaging Protocol
Where the Fragment Protocol contains the following fields:
Fragment Indicators / Fragment Sequence Number
and, where the Object Messaging Protocol contains the following fields:
Class ID / Instance ID / Service Code / Data
