# Communication Protocols of an Industrial Internet of Things Environment: A Comparative Study
## 3 MODBUS Theory
Here, a client query asks a server to read the values of three continuous input registers--register address \"14\" (0x000E), register address \"15\" (0x000F), and register address \"16\" (0x0010). Therefore, the client sends a single message \"000100000060104000E0003\" and the server replies by sending one frame \"000100000009010406 FE20 6666A63F\" that contains three values of continuous registers. The first register contains the hexadecimal value \"0 xFE20,\" which corresponds to the sixteen-bit signed short integer value \"11111110 0010000\" or the decimal value \"-480\". The last two registers hold the IEEE 754 short floating-point [45] representation \"0 xFA66666\" or the decimal value \"1.3\". Using the MODBUS specifications [30], the information from Table 1, and the MODBUS frame of Figure 1, the total consumed bytes (size) can be calculated via Equation (1). The formula is derived for the function code of \"read input registers\" (0x04) and is plotted in Figure 2, where N refers to the number of registers, which is doubled because each register contains two bytes:  
\[ \begin{split}&\mathit{Size}=\text{request\_bytes}+\text{ response\_bytes}\\ &=(7+5)+(9+2\times N)\\ &=2\times N+21\end{split} . \tag{1}\]  
For the request case, the header occupies 7 bytes, the function code occupies 1 byte, the start register-address occupies 2 bytes, and the quantity occupies 2 bytes. For the response case, the header occupies 7 bytes, the function code 1 byte, and the length 1 byte. Figure 1: MODBUS query and response, an illustrative example. The same principle is applied to other function codes, such as \"read holding registers\" (0x03), which has the same linear equation; \"write multiple registers\" (0x10), which can be represented by the linear equation (2\(*N+25\)); and \"write multiple coils\" (0x0F), which can be represented by the linear equation (\(N+25\)). As an example, if the number of registers (\(N\)) is 4, the size is 29 for the \"read input registers\" (0x04) and 33 for the \"write multiple registers\" (0x10) function codes. If the client application requires the execution of both operations--read and write--within the same message for a remote device, the function code \"read/write multiple registers\" (0x17) shows higher performance than both the \"read input registers\" (0x04) and the \"write multiple registers\" (0x10) function codes if used separately. Equation (2) illustrates two linear formulae for the function code \"read/write multiple registers\" (0x17), which sends both commands within the same message:  
\[\text{Bytes\_request}=17+2\times N_{\text{Read}} \tag{2}\] \[\text{Bytes\_response}=9+2\times N_{\text{Write}}\] \[\therefore\text{Total\_size}=26+2\times(N_{\text{Read}}+N_{\text{ Write}})\]  
Both equations of the function code \"read/write multiple registers\" (0x17) request and response are plotted in Figure 3. Both equations are linear and depend on the number of registers to be written (\(N_{\text{Write}}\)) and read (\(N_{\text{Read}}\)). As a result, the MODBUS TCP has an optimized frame structure suitable for SCADA-like systems and has a communication mechanism that fulfills the industrial requirements. In addition, it has a communication model and pattern that are compatible with industrial applications. As shown in Figures 1-3, the protocol is lightweight. Moreover, it has an open specification, and uses TCP/IP networks. Accordingly, it can be considered as an IoT protocol. Figure 2: Relationship between the number of bytes and the number of registers of function codes (FC) “read input registers” (0x04), “write multiple coils” (0x0F), and “write multiple registers” (0x10).