MODBUS TCP Developer Guide

(2022-12-30)
Format of MODBUS Protocol
The MODBUS protocol defines a simple Protocol Data Unit (PDU) independent of the basic
communication layer. The MODBUS protocol mapping on a specific bus or network can introduce
some additional fields on the Application Data Unit (ADU). That is, the PDU part of the MODBUS
protocol on different types of buses or networks is the same, and the main difference lies in the
address field and the error checking part.
The format of each MODBUS command is consistent with the MODBUS standard format.
Please refer to Appendix A: MODBUS Standard Protocol Reference.

ADU
Additional
Function code Data Error Check
address

PDU

Format of MODBUS TCP Protocol

The address field defined in MODBUS TCP contains the MBAP (MODBUS Application Protocol)
header. Since there is a checksum in TCP itself, no additional error checking part is necessary in
MODBUS-TCP.

ADU
MBAP Header Function Code Data

7 Byte 1 Byte Dependent on specific commands

PDU

The header format of MBAP is shown as following:

Transaction Identifier Protocol Identifier Length Unit Identifier
2 Byte 2 Byte (0x0000) 2 Byte 1 Byte

Field Description
It can be regarded as the serial number of the message. Generally,
1 is increased on every query to make the response uniquely
Transaction Identifier
assigned to the query. The server (the controller) copies the value
from the client's request in the response.

0x0000 represents the MODBUS TCP protocol. Because a MODBUS

Protocol Identifier
protocol is used, the field always has the value 0.

Length Representing the length of the next data in bytes.

It can be regarded as the device address, which is no longer
Unit Identifier important and can be ignored in most cases. The slave address has
been replaced by the IP address in a sense. The device will directly
 return the parameters requested by the client in this field.

PDU protocol description

Note: In the example, "[ ]" is used to mark the header of MBAP, but this symbol is not included

in the actual command.

Get measured temperature of measurement tools

Function Get measured temperature of measurement tools
Command Code 0x03 Register address range 0x00~0x3E
PDU protocol specification
Address Address Data
Byte Meaning
(Hexadecimal) (Decimal) Type
Max. temperature of the 1st measurement
0x00 0 2 INT
tool (or the image in normal mode)
Min. temperature of the 1st measurement tool
0x01 1 2 INT
(or the image in normal mode)
Avg. temperature of the 1st measurement tool
0x02 2 2 INT
(or the image in normal mode)
Max. temperature of the 2nd measurement
0x03 3 2 INT
tool
Min. temperature of the 2nd measurement
0x04 4 2 INT
tool (or the image in normal mode)
Avg. temperature of the 2nd measurement tool
0x05 5 2 INT
(or the image in normal mode)
…… …… …… ……
Max. temperature of the 21st measurement
0x3c 60 2 INT
tool
Min. temperature of the 21st measurement
0x3d 61 2 INT
tool
Avg. temperature of the 21st measurement
0x3e 62 2 INT
tool

Data Specification
1. The temperature data is an integer, and the measured temperature is equal to the register
value/10.0. For example, if the register value is 257, the measured temperature should be
25.7 ℃. The unit of temperature is always ℃.
 2. In Normal mode, register addresses 0x00, 0x01, and 0x02 are used for Maximum,
Minimum, and average temperatures of the image.
3. In Expert mode, more (from the second) measurement tools are available to measure
temperatures.
4. The range of positive numbers is 0x0000 - 0x7FFF in hexadecimal. The range of negative
numbers is transmitted in the complement of positive numbers, and the range is 0x8000-
0xFFFF in hexadecimal. For example, a temperature is uploaded as 0xFF9B in hexadecimal,
corresponding to 100 in decimal (0xFFFF - 0xFF9B = 0x64). It actually means - 10.0 ℃.
5. When a measurement tool is not enabled, the transmitted value is -273.1 °C and the
register value is 0xF554.

Illustrations
1. To request the maximum temperature, minimum temperature, and average temperature
of the 1st measurement tool, the three request messages are as follows:

Send Command: [00 01 00 00 00 06 01] 03 00 00 00 03

MBAP Header
Command Start Number of
Transaction Protocol Length Unit
Code Address Registers
Identifier Identifier Identifier
00 01 00 00 00 06 01 03 00 00 00 03

Receive Data: [00 01 00 00 00 09 01] 03 06 02 10 02 0a 02 0d

MBAP Header
Command Number
Transaction Protocol Length Unit Register Value
Code of Bytes
Identifier Identifier Identifier
00 01 00 00 00 09 01 03 06 0210 020a 020d
Register Value: Temperature Value = Register Value /10.0, Unit: ℃ 52.8 52.2 52.5
Note: The decimal of 0x0210 is 528. According to the formula, the maximum temperature of the
tool is 52.8 ℃.

2. Request the maximum temperature, minimum temperature, and average temperature of

the third and fourth rules. The 3rd tool is a spot tool, and the 4th tool is a rectangle tool.

Send Command: [00 01 00 00 00 06 01] 03 00 06 00 06

Receive Data: [00 01 00 00 00 0f 01] 03 0c 01 ff 01 ff 01 ff 02 00 01 fc 01 fe
Note: The maximum temperature, minimum temperature, and average temperature of the 3rd
measurement tool obtained at this time are 51.1 °C (0x01ff), 51.1 °C, and 51.1 °C, respectively.
The obtained maximum temperature, minimum temperature, and average temperature of the 4th
measurement tool are 51.2 °C (0x0200), 50.8 °C (0x01fc), and 51.0 °C (0x01fe), respectively.

3. Request a minimum temperature of the 7th measurement tool

Send Command: [00 01 00 00 00 06 01] 03 00 13 00 01
Receive Data: [00 01 00 00 00 05 01] 03 02 01 f8
Note: The minimum temperature of the 7th measurement tool is 50.4 °C (0x01f8).

Error Message
Standard Error Message
The standard error messages are subject to the MODBUS standard protocol, but some are
slightly different. For details, please refer to Appendix A: MODBUS Standard Protocol Reference.

Error Code Error Message

0x01 ILLEGAL FUNCTION
0x 02 ILLEGAL DATA ADDRESS
0x 03 ILLEGAL DATA VALUE
0x 04 SERVER DEVICE FAILURE

Private Error Message

Private error messages are additional messages defined by Hikvision, stating the results of
functions, and independent to the standard error codes.
Error Code Error Message
None None

Appendix

Appendix A: MODBUS Standard Protocol Reference

MODBUS standard protocol can be reached at the MODBUS organization website in link below.
https://MODBUS.org/docs/MODBUS_Application_Protocol_V1_1b3.pdf
For more MODBUS protocols, refer to the official MODBUS website: https://MODBUS.org/

Revision Notes
Date Revision Note
July 1, 2022 Created the document Hikvision MODBUSTCP Developer Guide
 December 30, 2022 Removed a section get protocol type state.
Added illustration about Normal mode.

Remarks:
 Hikvision reserves the right to change, alter or withdraw the above notification without prior

notice.

 Product design and specifications are subject to change without prior notice.

 The Hikvision firmware may contain errors known as errata which may cause the product to

deviate from published specifications. Current characterized errata are available on request.

 Hikvision is not liable for any typing or printing errors.

Hikvision Digital Technology CO., Ltd.

No. 555 Qianmo Road, Binjiang District, Hangzhou 310051,
China
Tel: +86-571-8807-5998
FAX: +86-571-8993-5635
Email: [email protected]