Modbus function codes and frame formats

Quick reference · Operator: GyeongSeop Kim

This page summarizes what a Modbus master sends and receives. You can try each function against a real device with WebModbus, a free online Modbus tool; see also Modbus online.

Data model

Coils: 1-bit, read/write (function 01 to read, 05 and 15 to write).
Discrete inputs: 1-bit, read-only (02).
Holding registers: 16-bit, read/write (03 to read, 06, 16, 22, 23 to write).
Input registers: 16-bit, read-only (04).

Addresses on the wire start at 0. Many device manuals list them as 00001, 10001, 30001, or 40001 plus a one-based offset, so register 40001 is address 0 in the request.

Function codes

01 (0x01) Read Coils: up to 2000 coils per request.
02 (0x02) Read Discrete Inputs: up to 2000 inputs.
03 (0x03) Read Holding Registers: up to 125 registers.
04 (0x04) Read Input Registers: up to 125 registers.
05 (0x05) Write Single Coil: value 0xFF00 is ON, 0x0000 is OFF.
06 (0x06) Write Single Register: one 16-bit value.
07 (0x07) Read Exception Status: serial line only.
08 (0x08) Diagnostics: serial line only; sub-function 0 returns the data you sent (loopback).
11 (0x0B) Get Comm Event Counter and 12 (0x0C) Get Comm Event Log: serial line only.
15 (0x0F) Write Multiple Coils: up to 1968 coils.
16 (0x10) Write Multiple Registers: up to 123 registers.
17 (0x11) Report Server ID: serial line only.
22 (0x16) Mask Write Register: result = (current AND and-mask) OR (or-mask AND NOT and-mask).
23 (0x17) Read/Write Multiple Registers: writes first, then reads, in one transaction.
43 / 14 (0x2B / 0x0E) Read Device Identification: vendor name, product code, revision.

Exception codes

A device that cannot perform a request replies with the function code plus 0x80 and one exception code:

01 Illegal Function: the device does not support that function.
02 Illegal Data Address: the address or address range is not valid. A common first fix is to check whether the manual's address is one-based.
03 Illegal Data Value: a value or quantity is out of range.
04 Server Device Failure: the device failed while handling the request.
06 Server Device Busy: try again later.
0A / 0B Gateway Path Unavailable / Gateway Target Device Failed to Respond: seen behind gateways.

Frame formats

RTU: binary, Slave ID · Function · Data · CRC-16 (low byte first, polynomial 0xA001). Frames are separated by 3.5 characters of silence.
ASCII: starts with :, hex characters, an LRC checksum, ends with CR LF.
TCP: a 7-byte MBAP header (transaction ID, protocol ID 0, length, unit ID) followed by the function and data. No CRC. Default port 502.

Try it

Open WebModbus, create a request window, press F8, and set the Slave ID, function code, address, and quantity. The Test Center lets you send raw frames; the CRC or LRC is added for you. See the guide for details.

← Open WebModbus · Modbus online · Guide · Privacy