Monigear Modbus TCP User Guide

Monigear Device - Modbus TCP Communication Protocol

1. Protocol Introduction

Modbus TCP uses Ethernet TCP/IP to transmit Modbus messages between sites. TCP/IP network provides data segmentation, confirmation, retransmission, addressing, routing, and other functions, ensuring that Modbus messages are correctly routed, reliably, and orderly transmitted between Ethernet devices, achieving efficient and reliable data exchange.

2. Client-Server Communication

Modbus TCP adopts a master-slave response method. The upper computer acts as the client (master) to send requests over the network, and the server (slave) processes the requests and sends back responses. The device acts as the server, actively listening to TCP port 502, waiting for client connection requests. After the connection is successfully established, it responds to data communication requests that comply with the Modbus TCP protocol.

3. Protocol Format

Modbus TCP data frame consists of the message header MBAP and the frame structure PDU. The MBAP header is 7 bytes long, composed as follows:

3.1 Description of each part of the MBAP:

The PDU frame structure consists of a function code and a data field. The function code is 1 byte long, and the length and content of the data field depend on the specific function. The function codes supported by the device are as follows:

3.2 Example: Reading Digital input

Request frame information: Read device address 1, coil starting address 0000, and read 8 coils.

Response frame information:

3.3 Example: Reading Analog Inputs

Request frame information: Read device address 0, register starting address 0002, and read 2 registers.

Response frame information:

3.4 Communication Errors

Typically, the master (computer) sends request data to the slave (device), and the slave responds and processes the request. However, communication errors may occur in the following situations:

TCP/IP network anomalies, detected by the master program as query timeout or network interruption.

The slave receives the request data without communication errors but cannot process it (e.g., reading a nonexistent register address) and reports the error to the master.

When the slave reports an error, the function code and data field differ from a normal response.

Function Code:

For normal responses, the slave's response function code is the same as the master's request function code. All function codes have an MSB of 0 (value less than 80H).

For abnormal responses, the slave sets the MSB of the function code to 1, making the value greater than 80H, higher than normal response values. The master application identifies abnormal response events by recognizing these values and checks the error code further.

Data Field:

For normal responses, the data field contains the data or statistics requested.

For abnormal responses, the data field contains an exception code explaining the condition and reason for the abnormal response.

Error Codes and Meanings

Example: Abnormal Response

Request frame information: Read device address 0, register starting address 0123, and read 2 registers.

Response frame information: Due to incorrect register starting address, the response indicates an illegal data address.

Enabling Modbus TCP Function on the Device

Use the network device configuration tool to connect to the device, then enable the Modbus TCP function in the basic settings.

Modbus TCP Function Configuration Items

The device's Modbus TCP function supports up to 3 clients connected to the device's TCP 502 port in server mode. Check the status statistics of this function in the technical support information.

Test Example

Using the network temperature and humidity transmitter MN-NHTM as an example, enable the Modbus TCP function and use the testing tool mbpoll to read real-time temperature and humidity data.

Refer to the following diagram for device IP and function settings, for example:

Viewing Current Temperature and Humidity

Open the mbpoll testing tool, select Connection -> Connect (shortcut key F3) from the menu bar, choose TCP/IP in the connection settings page, and enter the device's IP address and default port number 502.

After successfully connecting to the device using mbpoll, select Setup -> Read/Write Definition (shortcut key F8) from the menu bar. Set the Modbus TCP command's device address/SlaveID, function code, data address, quantity to read, and display method.

Viewing Real-Time Temperature and Humidity Values

Modbus Address Table

Common Modbus address table for devices.

In Modbus protocol, when function code 03 is used to read address 0, the corresponding register address described in the protocol is 40001. Therefore, if some software uses the standard protocol's 4xxxx format address representation, you should add 40001 to the address mapping table below to correspond to it.

Our WiFi series and PoE series use the same address table.

6.1 Network Temperature and Humidity Transmitter MN-NHTM/WTHM

Analog values (device address 0/255, function code 0x03)

6.2 Network series Gas transmitter

MN-NCO2 for monit CO2 concentration

Analog values (device address 0/255, function code 0x03)

MN-NCO2TH 3in1 indoor air quality monitor

Analog values (device address 0/255, function code 0x03)

MN-NVOC/WVOC 4in1 indoor air quality monitor

Analog values (device address 0/255, function code 0x03)

6.3 Multifunction Input/Output Module MN-NIO

Digital values (device address 0, function codes 0x01/0x05)

Note: The general used digital input interface corresponds to the dry contact sensor, and the actual name and 0/1 value description of each channel are defined depending on the sensor type. For example, the smoke alarm connected to DI1 is actually called smoke detector status, 0: normal 1: alarm.

Analog values (device address 0, function code 0x03)

Note: The general used analogue input interface corresponds to industrial standard 4-20mA sensors, and the actual name and unit of each channel depends on the sensor type. For example, AI1 is connected to a 4-20mA water level transmitter, which is actually called water level. In addition, the upper and lower limits of analog quantities are further set according to the range of the sensor.

MODBUS address table for function code 4

In the address table of function code 3 above, when reading each analog value, two consecutive registers (2 bytes each register) are read to represent a 4-bytes float data. This representation style is inherited from our monitoring host. Because it is a general interface that may connect to various type sensors, and the range of sensor values cannot be determined in advance, using the float data to represent a wide range of sensor data can be applied to various industrial SCADA applications.

However, some customers have reported that this data parsing method is complicated when connecting to their software. Therefore, for our temperature, humidity and gas series sensors, since the data range is known, we have made a firmware upgrade to provide data response based on function code 4, where each register represents the value of an analog supervisory point.

Note: Function code 4 is only supported on firmware versions with a date after 2026/01/17. Older devices can gain this feature through upgrades under our guidance, please contact our technical support before upgrade.

In MODBUS protocol, when function code 04 is used to read address 0, the corresponding register address described in the protocol is 30001. Therefore, if some software uses the standard protocol's 3xxxx format address representation, you should add 30001 to the address mapping table below to correspond to it.

MN-NTHM/WTHM temperature and humidity transmitter，

Analog values (device address 0/255, function code 0x04)

MN-NCO2TH 3in1 indoor air quality monitor

Analog values (device address 0/255, function code 0x04)

MN-NVOC/MN-WVOC 4in1 indoor air quality monitor

Analog values (device address 0/255, function code 0x04)