日本語 English

Modbus

Overview

Modbus is a communication protocol used to connect industrial electronic devices
This page briefly explains Modbus frames
At the end of this page there is a link to an application for communication testing

Type

  • Modbus-ASCII
  • Modbus-RTU
  • Modbus-TCP

About Addresses

Modbus uses four kinds of addresses
TypeAddress rangeData type
Coil1-99991bit
Input Status10001-199991bit
Input Register30001-3999916bit
Holding Register40001-4999916bit

Message Frames

Modbus-ASCII

Modbus-ASCII is a character string message communicated over RS-422 or RS-485

Message frame that reads 2 values starting at holding register 40001
Send message
HeaderSlave addressFunctionDataLRCFooter
AddressCount
":""01""03""0000""0002""FA"CR＋LF
1 char2 chars2 chars4 chars4 chars2 chars2 chars
Receive message
HeaderSlave addressFunctionNumber of bytes received Data 1Data 2LRCFooter
HighLowHighLow
":""01""03""06""00""01""00""02""F3"CR＋LF
1 char2 chars2 chars2 chars2 chars2 chars2 chars2 chars2 chars2 chars

LRC Calculation

Convert the characters from the slave address to the data into numbers (hex), sum them, and take the two's complement of the lower 2 digits (+1)
In the example above, 0+1+0+3+0+0+0+0+0+0+0+2=6, and its two's complement +1 should be "FA"

Example of reading 2 values from address 40017
The address is 4017-40001=16 (0x0010) and the count is 2 (0x0002), so
0+1+0+3+0+0+1+0+0+0+0+2=7 (0x07), and its two's complement +1 should be "F9"
(in hex: 0x00+0x01+0x00+0x03+0x00+0x00+0x01+0x00+0x00+0x00+0x00+0x02)

Example of reading 20 values from address 40201
The address is 40201-40001=200 (0x00C8) and the count is 20 (0x0014), so
0+1+0+3+0+0+12+8+0+0+1+4=29 (0x1D), and its two's complement +1 should be "E3"
(in hex: 0x00+0x01+0x00+0x03+0x00+0x00+0x0C+0x08+0x00+0x00+0x01+0x04)

Modbus-RTU

Modbus-RTU is a binary message communicated over RS-422 or RS-485

Send message
HeaderSlave addressFunctionDataCRCFooter
AddressCount
(*1)0x010x030x00 0x000x00 0x020xC4 0x0B(*1)
1byte1byte2byte2byte2byte (*2)
Receive message
HeaderSlave addressFunctionNumber of bytes receivedData 1 Data 2CRCFooter
HighLowHighLow
(*1)0x010x030x060x000x010x000x020x53 0xF2(*1)
1byte1111112
*1) Silent interval of 3.5 characters (no communication)
*2) Low byte is sent first

CRC Calculation

CRC16 with right shift, initial value 0xFFFF, apparently no inversion...
You can calculate it with this app

Modbus-TCP

Modbus-TCP is a binary message communicated over Ethernet

Send message
Transaction IDProtocol IDNumber of bytes transferredUnit IDFunctionData
AddressCount
0x00 0x000x00 0x000x00 0x060x010x030x00 0x000x00 0x02
2byte2byte2byte1byte1byte2byte2byte
Receive message
Transaction IDProtocol IDNumber of bytes transferredUnit IDFunction
 
0x00 0x000x00 0x000x00 0x070x010x03
2byte 2byte2byte1byte1byte

Number of bytes receivedData 1Data 2
HighLowHighLow
0x040x000x010x000x02
1byte1byte1byte1byte1byte

Function

List
FunctionNameFunctions
01Read Coil StatusReading coils
02Read Input StatusRead discrete inputs
03Read Holding RegisterRead holding registers
04Read Input RegisterRead input registers
05Force Single CoilWrite coil
06Preset Single RegisterWrite holding register
08DiagnosticsDiagnostics
11(0x0B)Fetch Communication Event CounterGet comm event counter
12(0x0C)Fetch Communication Event LogGet comm event log
15(0x0F)Force Multiple CoilsWrite multiple coils
16(0x10)Force Multiple RegistersWrite multiple registers
17(0x11)Report Slave IDReport slave ID

About addresses
To specify coil address 20, specify 19 (0x13), which is 20 minus 1
Likewise, input status, holding register and input register addresses are specified as the number minus 1

(01) Read Coil Status

Example of reading 20 coils starting at coil 1

Send message
FunctionAddressCount
0x010x00 0x000x00 0x14
Receive message
FunctionNumber of bytes receivedData 1-8Data 9-16Data 17-24
0x010x030x010x000x08

Bit order
Data is filled from the LSB (bit 0), and the remainder is padded with 0
Example: if coils 0 and 20 are ON, data 1-8 is 0x01 and data 17-24 is 0x08

(02) Read Input Status

Example of reading 20 input statuses starting at input status 20

Send message
FunctionAddressCount
0x020x00 0x130x00 0x14
Receive message
FunctionNumber of bytes receivedData 1-8Data 9-16Data 17-24
0x020x030x010x000x08

(03) Read Holding Register

Example of reading 3 values starting at holding register 20

Send message
FunctionAddressCount
0x030x00 0x130x00 0x03
Receive message
FunctionNumber of bytes receivedData 1Data 2Data 3
0x030x060x00 0x000x00 0x010x00 0x02

(04) Read Input Register

Example of reading 3 values starting at input register 20

Send message
FunctionAddressCount
0x040x00 0x130x00 0x03
Receive message
FunctionNumber of bytes receivedData 1Data 2Data 3
0x040x060x00 0x000x00 0x010x00 0x02

(05) Force Single Coil

Example of turning coil 20 ON

Send message
FunctionAddressCount
0x050x00 0x130xFF 0x00
Receive message
FunctionAddressData
0x050x00 0x130xFF 0x00

How to specify data
0x00 0x00 = OFF, 0xFF 0x00 = ON

(06) Preset Single Register

Example of setting holding register 20 to 0x1234

Send message
FunctionAddressData
0x060x00 0x130x12 0x34
Receive message
FunctionAddressData
0x060x00 0x130x12 0x34

(08) Diagnostics

Example of returning an echo

Send message
FunctionDiagnostic subcodeData
0x080x00 0x000x12 0x34
Receive message
FunctionDiagnostic subcodeData
0x080x00 0x000x12 0x34
Diagnostic subcode
Diagnostic subcodeDataFunctions
0x00 0x000x?? 0x??Echo
0x00 0x010x00 0x00Initialization
0xFF 0x00Also clears the event log
0x00 0x020x00 0x00Read diagnostic register
0x00 0x040x00 0x00Read-only mode
0x00 0x0A0x00 0x00Clear counters and diagnostic register
0x00 0x0B0x00 0x00Read total messages
0x00 0x0C0x00 0x00Read CRC error count
0x00 0x0D0x00 0x00Read exception response count
0x00 0x0E0x00 0x00Read received message count
0x00 0x0F0x00 0x00Number of messages with no response returned
0x00 0x110x00 0x00Slave busy exception response count
0x00 0x120x00 0x00Character overrun count

(11) Fetch Communication Event Counter

Example of reading the status word and event counter

Send message
Function
0x0B
Receive message
FunctionStatusEvent counter
0x0B0x00 0x000x12 0x34

(12) Fetch Communication Event Log

Example of returning an echo

Send message
Function
0x0C
Receive message
FunctionByte countStatus
0x0C0x080x00 0x00
Event counterMessage counterEvent 0Event 1
0x12 0x340x12 0x340x200x00

(15) Force Multiple Coils

Example of changing the values of 10 coils starting at coil 20
Write data (20-29) = 1100 0000 01

Send message
FunctionAddressCountByte countData
0x0F0x00 0x130x00 0x0A0x020x03 0x02

Bit order in the data
(No. 20) 1100 0000 01 (No. 29) → data byte 1 (27) 0000 0011 (20), byte 2 (36) ---- --10 (28)

Receive message
FunctionAddressCount
0x0F0x00 0x130x00 0x0A

(16) Preset Multiple Registers

Example of changing the values of 3 holding registers starting at holding register 20
Write data (20-22) = 0x0001 0x0002 0x0003

Send message
FunctionAddressCountByte countData 1Data 2Data 3
0x100x00 0x130x00 0x030x060x00 0x010x00 0x020x00 0x03
Receive message
FunctionAddressCount
0x100x00 0x130x00 0x03

(17) Report Slave ID

Example of reading slave information

Send message
Function
0x11
Receive message
FunctionThe following varies by device
0x11...

Exception Responses

(03) When the address does not exist when executing Read Holding Register
Receive message
FunctionException code
0x830x02

Most significant bit of the function
In the received data for an error, the function is returned with its most significant bit ON

Exception code
Exception codeName
01Illegal function
02Illegal data address
03Illegal data value

Related pages

Applications

TCP and UDP communication test tool

Analyze and test TCP and UDP communication

ComCom

An application that sends messages you create using Ethernet socket communication

ModbusTCP test tool

Analyze and test Modbus communication

ModbusTcpMes

An application that sends ModbusTcp queries (commands) using Ethernet socket communication

Comments