The structure of the request and response body in Modbus TCP connections, from the function code to the end of the data portion, has exactly the same layout and meaning as in the other MODBUS variants, such as Modbus RTU or Modbus ASCII. The only differences in these other cases are the form of any ‘framing’ sequence, error check pattern, and address interpretation.

The request and response are prefixed by eight bytes as follows:

byte 0:

transaction identifier – copied by server – usually 0

byte 1:

transaction identifier – copied by server – usually 0

byte 2:

protocol identifier = 0

byte 3:

protocol identifier = 0

byte 4:

length field (upper byte) 

byte 5:

length field (lower byte) 

byte 6:

unit identifier 

byte 7:

MODBUS function code

byte 8 onwards:


Table 1 Modbus TCP framing

The SME uses the Modbus function code x04, which allows to read the input registers of the device where all the parameters are mapped. All other function codes of the Modbus TCP protocol are unused and will not be mentioned in this document. 


Function Code (Dec)




Read Input Registers

Read Analog Inputs (AI)


The measured parameters are mapped into the Modbus input registers; the variable associated with each parameter is listed in Table 2. 




Parameter 0

Viscosity median 

Takes the median of the last 5 sensor measurements points

Parameter 1

Density median

Parameter 2

Temperature median

Parameter 3

Kinematic Viscosity

Parameter 4

Density average

Calculates the average of the last 5 measurement points

Parameter 5

Viscosity raw ‘process measurement’

Reads the direct measurement taken by the sensor.

Parameter 6

Density raw

Parameter 7

Temperature raw

Parameter 12

Viscosity Last Good

Keeps the last-good median measurement in memory when there is a measurement error

Parameter 13

Density Last Good


Error State

Error state of the sensor

Table 2 Measured parameters list