What is the correct response to a modbus request with too few data bytes?

Question

In a Modbus server implementation, what response should the server send if it receives a request from the client that contains too few (or no) data bytes to interpret correctly?

For example, a modbus RTU server (with address 0x01) receives the ADU datagram: 0x01, 0x01, 0xE0, 0xC1. In this case no physical transport layer errors are detected, the address is correct, the CRC is correct and the function (Read Coils) is correct and implented on the server, but the PDU does not contain the Starting Address or Quantity of Inputs fields required to process the request.

Should the server assume that a (very rare) bit error has occurred and not respond at all? Should the server interpret this as 'a value in the query data field' being not allowed for the server and respond with an ILLEGAL DATA VALUE exception? Should the server do something completely different?

Answer 1

In my experience, at least with Modbus TCP, devices tend to just ignore malformed requests.

Answer 2

From the specification MODBUS APPLICATION PROTOCOL SPECIFICATION V1.1b3 the exception (code 3) is correct. Figure 9 MODBUS Transaction state diagram clearly indicates the exception response to an incorrectly formed message.

I suspect the common response that rejects the message is indistinguishable from a transmission error, and the implementor of the faulty client will then be induced to correct their implementation.

Your suggestion that a communication error triggers this is possible, but only if the underlying link does not detect missing bytes. Any byte, other than 0xFF will introduce a start bit into a serial channel, and a missing byte in the TCP/UDP implementations is even less likely.