# Communication Protocols of an Industrial Internet of Things Environment: A Comparative Study
## 3 MODBUS Theory  
The MODBUS TCP is a byte-oriented, industrial communication protocol, open de facto standard, used for data exchange between embedded systems, devices, and industrial applications. Devices, reacting as clients, may benefit from the inexpensive implementation of such a lightweight protocol for polling industrial devices that react as servers. Polling communications follow the request-response mechanism, where a client queries the server for specific data or executes commands in the server using a frame of bytes arranged in a specific way, called a frame format. The server replies to the client queries via a frame of bytes either holding measurement data from sensors or confirming the execution of commands. Sixteen-bit data registers store measurement values, and coils hold the status of ON and OFF switches. Therefore, MODBUS TCP uses the polling mechanism, as opposed to the event-based mechanism, explained in the next section. As listed in Table 1, the protocol specifications [30] define three categories of function codes for the access of data in remote devices. These data are stored in coils or registers as status values for measurements or transferred as setpoints for control. Coils perform one-bit read and write operations for switching the attached devices ON and OFF or reading and writing one-bit internal configuration values. Discrete inputs perform one-bit read operations for reading the status of the attached devices, whether they are switched ON or OFF. The 16-bit input registers are responsible for measurements from physical devices, and the 16-bit holding registers perform read and write operations related to internal reconfigurable values. \begin{table}
\begin{tabular}{c c c c} \hline
**Data Access** & **Type** & **Function Code** & **Meaning** \\ \hline
1 bit & physical discrete input & 0x02 & read discrete inputs \\
1 bit & internal bits, physical coils & 0x01 & read coils \\
1 bit & internal bits, physical coils & 0x05 & write single coil \\
1 bit & internal bits, physical coils & 0x0F & write multiple coils \\
16 bit & physical input registers & 0x04 & read input registers \\
16 bit & internal and physical output registers & 0x03 & read holding registers \\
16 bit & internal and physical output registers & 0x06 & write single register \\
16 bit & internal and physical output registers & 0x10 & write multiple registers \\
16 bit & internal and physical output registers & 0x17 & read/write registers \\
16 bit & internal and physical output registers & 0x16 & mask write register \\
16 bit & internal and physical output registers & 0x18 & read first in first out (FIFO) queue \\ \hline \end{tabular}
\end{table} 
Table 1: Function codes for data access in MODBUS. A message structure of a MODBUS TCP client query for reading input registers is shown in Figure 1. The slave replies to the master query in the same format with the read registers using the function code (FC) \"read input registers\" (FC = 0x04), or as a confirmation to executing commands in case of other function codes such as \"write single coil\" (FC = 0x05). The header of the MODBUS frame consists of four fields: a two-byte transaction identifier (ID); a two-byte protocol type (MODBUS over TCP); a two-byte length, which counts the number of bytes for the rest fields; and a one-byte unit identifier (Unit). However, the protocol data unit (PDU) consists of a one-byte function code (FC), which is, here, a code to read the registers and a data field that may contain other fields depending on the FC itself. Both the header and the PDU form an application data unit (ADU), which is the complete frame of the query. The following illustrative example explains the principle of the MODBUS frame format that uses a function code (0x04) to read three continuous input registers in a remote device. The function is able to read from 1 to 125 contiguous input registers.