A Modbus TCP request is not an RTU frame sent over a socket. Wrap the Modbus Protocol Data Unit (PDU) in a Modbus TCP header, retain the unit identifier in that header, and omit the RTU CRC.
Convert the RTU Query to a TCP Request
The RTU query in the evidence is 01 03 0F A0 00 0A 46 FB. Its PDU is 03 0F A0 00 0A: function 03, starting address 0F A0, and quantity 00 0A. Do not transmit the RTU address byte 01 or CRC bytes 46 FB as part of the TCP PDU.
| RTU element | Modbus TCP handling |
|---|---|
01 device address |
Place the unit identifier in the TCP header, not at the start of the PDU. |
03 0F A0 00 0A |
Send as the PDU. |
46 FB CRC |
Omit; a Modbus TCP frame does not carry the RTU CRC. |
Build the Modbus TCP Frame
Send a complete Modbus TCP application data unit: a TCP header followed by the PDU. The transaction identifier lets the client associate the reply with its request. Set the protocol identifier and length according to the Modbus TCP specification, then place the target unit identifier before the PDU.
[Transaction identifier]
[Protocol identifier]
[Length]
[Unit identifier]
03 0F A0 00 0A
Do not send only 03 0F A0 00 0A unless the application library explicitly creates the TCP header for you.
Interpret the Response
The response is also a Modbus TCP frame. Parse its TCP header first, verify that its transaction identifier matches the outstanding request, and then parse the response PDU. A successful function 03 response contains the function code, a byte-count field, and the returned register data. Do not expect an RTU CRC at the end.
Keep the unit identifier separate from the response PDU. It appears in the TCP header, so describing the response as entirely “excluding the device ID” is incomplete: the RTU-style leading address is absent, but the TCP frame still has a unit-identifier field.
Verify the Destination Port
- Confirm whether
199.199.20.13:2000identifies the PLC/server destination or the client's local socket. The evidence does not resolve that ambiguity. - Verify the port on which the PLC's Modbus TCP service is listening. The supplied evidence identifies port
502for the PLC, while the attempted connection uses port2000. - After connecting, send one complete TCP frame and verify the matching transaction identifier, unit identifier, function code, and returned data before issuing additional requests.
FAQ
Do I send the Modbus RTU CRC over Modbus TCP?
No. Remove CRC bytes 46 FB from the supplied RTU query and send the PDU inside a Modbus TCP frame.
Where does slave address 01 go in a Modbus TCP request?
Place 01 in the TCP header's unit-identifier field. Do not prepend it to the function 03 PDU.
Should I connect to Modbus TCP port 2000 or 502?
The evidence identifies 502 as the PLC port but shows an attempted connection to 199.199.20.13:2000. Confirm the PLC's configured listening port and ensure the socket uses it as the remote destination.