The structure of the request and response body in Modbus TCP connections, from the function code to the end of the data portion, has exactly the same layout and meaning as in the other MODBUS variants, such as Modbus RTU or Modbus ASCII. The only differences in these other cases are the form of any ‘framing’ sequence, error check pattern, and address interpretation.

The request and response are prefixed by eight bytes as follows:

byte 0:

transaction identifier – copied by server – usually 0

byte 1:

transaction identifier – copied by server – usually 0

byte 2:

protocol identifier = 0

byte 3:

protocol identifier = 0

byte 4:

length field (upper byte) 

byte 5:

length field (lower byte) 

byte 6:

unit identifier 

byte 7:

MODBUS function code

byte 8 onwards:


Table 1 Modbus TCP framing

The SME uses the Modbus function code x04, which allows to read the analog inputs of the device. All other function codes of the Modbus TCP protocol are unused and will not be mentioned in this document. 


Function Code (Dec)




Read Input Registers

Read Analog Inputs (AI)


The measured parameters are mapped into the Modbus input registers; the variable associated with each parameter is listed in Table 2. 




Parameter 1

Viscosity median 

Takes the median of the last 5 sensor measurements points

Parameter 2

Density median

Parameter 3

Temperature median

Parameter 4

Viscosity average 

Calculates the average of the last 5 measurement points

Parameter 5

Density average

Parameter 6

Viscosity raw ‘process measurement’

Reads the direct measurement taken by the sensor.

Parameter 7

Density raw

Parameter 8

Temperature raw

Parameter 9

Viscosity Last Good

Keeps the last-good median measurement in memory when there is a measurement error

Parameter 10

Density Last Good


Error State

Error state of the sensor

Table 2 Measured parameters list