Modbus TCP — MBAP header and gateways

Modbus TCP ADU

Modbus TCP carries the application PDU (function code + data) with a 7-byte MBAP header (Modbus Application Protocol header) over TCP to port 502. There is no device address or CRC as in RTU: IP addresses the device, TCP ensures integrity.

All fields are big-endian. Maximum ADU size is 260 bytes (7 + 253).

Example

Read two holding registers at address 0:

00 01  00 00  00 06  01  03 00 00 00 02
└─┬─┘  └─┬─┘  └─┬─┘  │   └──────┬─────┘
  │      │      │    │        PDU: function 03, address 0, quantity 2
  │      │      │    Unit Identifier = 1
  │      │      Length = 6 (1 byte Unit ID + 5 bytes PDU)
  │      Protocol Identifier = 0
  Transaction Identifier = 1

The response repeats the Transaction Identifier, has Length = 7 and the PDU 03 04 xx xx xx xx.

Unit Identifier

• A device with native Modbus TCP (PLC, drive with an Ethernet option) usually ignores the Unit ID or expects a specific value — often 1, 0 or 255. Check the manual: with a wrong value some devices do not respond.
• A Modbus TCP → RTU gateway uses the Unit ID as the device address on the RS-485 line. A request with Unit ID 5 goes to device 5 on the serial bus.

Through a gateway

The gateway converts the TCP request into an RTU frame, waits for the response and returns it. Things to know:

• Response time adds TCP, the gateway queue and the RS-485 exchange; the client timeout must allow for it.
• If the device behind the gateway does not answer, the gateway may return exception 0B (GATEWAY TARGET DEVICE FAILED TO RESPOND); a routing error gives 0A.
• Serial line settings (baud rate, parity) are configured in the gateway.

Concurrent connections

A client may send several requests without waiting and match responses by Transaction Identifier, but many servers process requests one at a time and limit the number of TCP connections (sometimes 1–4). When several SCADA systems poll one device, check that limit.