The following information provides an analysis of the Modbus Application Protocol.
The Modbus Application Protocol PDU is transmitted over a TCP/IP Ethernet . Both Ethernet II and IEEE 802.3 framing will be accommodated. Ethernet II framing is the default.
. . . from the wire in for IEEE 802.3 framing . . .
. . . is IEEE 802.3 framing if length <=1500 . . .802.3_pdu ::= {dst_addr[6], src_addr[6], length[2], data=802.2_pdu} *an IEEE 802.3 PDU has a maxFrameSize of 1518 octets
*an IEEE 802.3 PDU has a minFrameSize of 64 octets802.2_pdu : {dsap[1], ssap[1], frm_cntrl[1], snap_hdr[5], data=ip_pdu} *the snap_hdr is associated with a "well-known" 802.2 sap snap_hdr
::={org_code[3], ethertype[2] }
*the snap hdr (sub network access protocol) allows the older style
Ethernet protocols to run on the newer IEEE 802.2 interface. The
ethertype parameter indicates the service, ex. ip or arp. IP has a value
0x800. . . . from the wire in for Ethernet II framing . . .
. . . is Ethernet II framing if length >1500 . . .802.3_pdu ::= {dst_addr[6], src_addr[6], length[2], data=ip_pdu} . . . the common part of the packet begins here . . .ip_pdu ::= {ip_hdr[20], data=tcp_pdu}tcp_pdu ::= {tcp_hdr[24], data=appl_pdu=mbap_pdu}
The mbap_pdu is the Modbus Application Protocol whose messages are received at a well-known port. The current maximum size of the mbap_pdu for this class of services in 256 bytes.
The structure and content of the mbap_pdu is defined to be:
mbap_pdu ::={ inv_id[2], proto_id[2], len[2], dst_idx[1], data=mb_pdu }The header is 7 bytes long, and includes the following fields:
inv_id [2 bytes] invocation id used for transaction pairing proto_id [2 bytes] used for intra-system multiplexing, default is 0 for Modbus
services len [2 bytes] the len field is a byte count of the remaining fields and
includes the dst_id and data fields.
The remainder of the pdu includes two fields:
dst_idx [1 byte] destination index is used for intra-system routing of
packets. (currently not implemented) data [n bytes] this is the service portion of the Modbus pdu, mb_pdu, and is
defined below
The service portion of the Modbus Application Protocol, called mb_pdu, contains 2 fields:
mb_pdu ::= { func_code[1], data[n] }
func_code [1 byte] MB function code data [n bytes] this field is function code dependent and usually contains
information such as variable references, variable counts, and data offsets.
The size and content of the data field are dependent on the value of the function code.
