Object type | Access | Size |
---|---|---|
Coil | Read-write | 1 bit |
Discrete input | Read-only | 1 bit |
Input register | Read-only | 16 bits |
Holding register | Read-write | 16 bits |
Name | Length (bits) | Function |
---|---|---|
Start | 28 | At least 3½ character times of silence (mark condition) |
Address | 8 | Station address |
Function | 8 | Indicates the function code; e.g., read coils/holding registers |
Data | n × 8 | Data + length will be filled depending on the message type |
CRC | 16 | Cyclic redundancy check |
End | 28 | At least 3½ character times of silence between frames |
8005
and reversed A001
).01 04 02 FF FF B8 80
(CRC-16-ANSI calculation from 01
to FF
gives 80B8
, which is transmitted least significant byte first).Name | Length (bytes) | Function |
---|---|---|
Start | 1 | Starts with colon : (ASCII hex value is 3A ) |
Address | 2 | Station address |
Function | 2 | Indicates the function codes like read coils / inputs |
Data | n × 2 | Data + length will be filled depending on the message type |
LRC | 2 | Checksum (Longitudinal redundancy check) |
End | 2 | Carriage return – line feed (CR/LF) pair (ASCII values of 0D , 0A ) |
7A
.60
in hexadecimal. Hence the following frame: :F7031389000A60<CR><LF>
.Name | Length (bytes) | Function |
---|---|---|
Transaction identifier | 2 | For synchronization between messages of server and client |
Protocol identifier | 2 | 0 for Modbus/TCP |
Length field | 2 | Number of remaining bytes in this frame |
Unit identifier | 1 | Slave address (255 if not used) |
Function code | 1 | Function codes as in other variants |
Data bytes | n | Data as response or commands |
Function type | Function name | Function code | ||
---|---|---|---|---|
Data Access | Bit access | Physical Discrete Inputs | Read Discrete Inputs | 2 |
Internal Bits or Physical Coils | Read Coils | 1 | ||
Write Single Coil | 5 | |||
Write Multiple Coils | 15 | |||
16-bit access | Physical Input Registers | Read Input Registers | 4 | |
Internal Registers or Physical Output Registers | Read Multiple Holding Registers | 3 | ||
Write Single Holding Register | 6 | |||
Write Multiple Holding Registers | 16 | |||
Read/Write Multiple Registers | 23 | |||
Mask Write Register | 22 | |||
Read FIFO Queue | 24 | |||
File Record Access | Read File Record | 20 | ||
Write File Record | 21 | |||
Diagnostics | Read Exception Status | 7 | ||
Diagnostic | 8 | |||
Get Com Event Counter | 11 | |||
Get Com Event Log | 12 | |||
Report Slave ID | 17 | |||
Read Device Identification | 43 | |||
Other | Encapsulated Interface Transport | 43 |
02 E5 06
in hexadecimal.0x80
) (3 becomes 131 = hex 0x83
), and will only include one byte of data, known as the exception code.Code | Text | Details |
---|---|---|
1 | Illegal Function | Function code received in the query is not recognized or allowed by slave |
2 | Illegal Data Address | Data address of some or all the required entities are not allowed or do not exist in slave |
3 | Illegal Data Value | Value is not accepted by slave |
4 | Slave Device Failure | Unrecoverable error occurred while slave was attempting to perform requested action |
5 | Acknowledge | Slave has accepted request and is processing it, but a long duration of time is required. This response is returned to prevent a timeout error from occurring in the master. Master can next issue a Poll Program Complete message to determine whether processing is completed |
6 | Slave Device Busy | Slave is engaged in processing a long-duration command. Master should retry later |
7 | Negative Acknowledge | Slave cannot perform the programming functions. Master should request diagnostic or error information from slave |
8 | Memory Parity Error | Slave detected a parity error in memory. Master can retry the request, but service may be required on the slave device |
10 | Gateway Path Unavailable | Specialized for Modbus gateways. Indicates a misconfigured gateway |
11 | Gateway Target Device Failed to Respond | Specialized for Modbus gateways. Sent when slave fails to respond |