01(0x01) Read Coils
This function code is used to read from 1 to 2000 contiguous status of
coils in a remote device. The Request PDU specifies the starting
address, i.e. the address of the first coil specified, and the number
of coils. In the PDU Coils are addressed starting at zero. Therefore
coils numbered 1-16 are addressed as 0-15.The coils in the response message are packed as one coil per bit of the data field. Status is indicated as 1= ON and 0= OFF. The LSB of the first data byte contains the output addressed in the query. The other coils follow toward the high order end of this byte, and from low order to high order in subsequent bytes.
If the returned output quantity is not a multiple of eight, the remaining bits in the final data byte will be padded with zeros (toward the high order end of the byte). The Byte Count field specifies the quantity of complete bytes of data.
Request
Response
*N = Quantity of Outputs / 8, if the remainder is different of 0 -> N = N+1
Error
02(0x02) Read Discrete Inputs
This function code is used to read from 1 to 2000 contiguous status of discrete inputs in a remote device. The Request PDU specifies the starting address, i.e. the address of the first input specified, and the number of inputs. In the PDU Discrete Inputs a re addressed starting at zero. Therefore Discrete inputs numbered 1 -16 are addressed as 0-15.The discrete inputs in the response message are packed as one input per bit of the data field. Status is indicated as 1= ON; 0= OFF. The LSB of the first data byte contains the input addressed in the query. The other inputs follow toward the high order end of this byte, and from low order to high order in subsequent bytes.
If the returned input quantity is not a multiple of eight, the remaining bits in the final d ata byte will be padded with zeros (toward the high order end of the byte). The Byte Count field specifies the quantity of complete bytes of data.
Request
Response
*N = Quantity of Outputs / 8, if the remainder is different of 0 -> N = N+1
Error
03(0x03) Read Holding Registers
This function code is used to read the contents of a contiguous block of holding registers in a remote device. The Request PDU specifies the starting register address and the number of registers. In the PDU Registers are addressed starting at zero. Therefore registers numbered 1-16 are addressed as 0-15.The register data in the response message are packed as two bytes per register, with the binary contents right justified within each byte. For each register, the first byte contains the high order bits and the second contains the low order bits.
Request
Response
*N = Quantity of registers
Error
04(0x04) Read Input Registers
This function code is used to read from 1 to 125 contiguous input registers in a remote device. The Request PDU specifies the starting register address and the number of registers. In the PDU Registers are addressed starting at zero. Therefore input registers n umbered 1-16 are addressed as 0-15.The register data in the response message are packed as two bytes per register, with the binary contents right justified within each byte. For each register, the first byte contains the high order bits and the second contains the low order bits.
Request
Response
*N = Quantity of registers
Error
05(0x05) Write Single Coil
This function code is used to write a single output to either ON or OFF in a remote device.The requested ON/OFF state is specified by a constant in the request data field. A value of FF 00 hex requests the output to be ON. A value of 00 00 requests it to be OFF. All other values are illegal and will not affect the output.
The Request PDU specifies the address of the coil to be forced. Coils are addressed starting at zero. Therefore coil numbered 1 is addressed as 0. The requested ON/OFF state is specified by a constant in the Coil Value field. A value of 0XFF00 requests the coil to be ON. A value of 0X0000 requests the coil to be off. All other values are illegal and will not affect the coil.
The normal response is an echo of the request, returned after the coil state has been written.
Request
Response
Error
06(0x06) Write Single Register
This function code is used to write a single holding register in a remote device.The Request PDU specifies the address of the register to be written. Registers are addressed starting at zero. Therefore register numbered 1 is addressed as 0.
The normal response is an echo of the request, returned after the register contents have been written.
Request
Response
Error
07(0x07) Read Exception Status (Serial Line only)
This function code is used to read the contents of eight Exception Status outputs in a remote device.The function provides a simple method for accessing this information, because the Exception Output references are known (no output reference is needed in the function).
The normal response contains the status of the eight Exception Status outputs. The outputs are packed into one data byte, with one bit per output. The statu s of the lowest output reference is contained in the least significant bit of the byte.
The contents of the eight Exception Status outputs are device specific.
Request
Response
Error
08(0x08) Diagnostics (Serial Line only)
MODBUS function code 08 provides a series of tests for checking the communication system between a client device and a server, or for checking various internal error conditions within a server.The function uses a two–byte sub-function code field in the query to define the type of test to be performed. The server echoes both the function code and sub -function code in a normal response. Some of the diagnostics cause data to be returned from the remote device in the data field of a normal response.
In general, issuing a diagnostic function to a remote device does not affect the running of the user program in the remote device. User logic, like discrete and registers, is not accessed by the diagnostics. Certain functions can optionally reset error counters in the remote device.
A server device can, however, be forced into ‘Listen Only Mode’ in which it will monitor the messages on the communications system but not respond to them. This can affect the outcome of your application program if it depends upon any fu rther exchange of data with the remote device. Generally, the mode is forced to remove a malfunctioning remote device from the communications system.
The following diagnostic functions are dedicated to serial line devices.
The normal response to the Return Query Data request is to loopback the same data. The function code and sub-function codes are also echoed.
Request
Response
Error
Sub-function codes supported by the serial line devices
Here the list of sub-function codes supported by the serial line devices.
11(0x0B) Get Comm Event Counter (Serial Line only)
This function code is used to get a status word and an event count from the remote device's communication event counter.By fetching the current count before and after a series of messages, a client can determine whether the messages were handled normally by the remote device.
The device’s event counter is incremented once for each successful message completion. It is not incremented for exception responses, poll commands, or fetch event counter commands.
The event counter can be reset by means of the Diagnostics function (code 08), with a sub - function of Restart Communications Option (code 00 01) or Clear Counters and Diagnostic Register (code 00 0A).
The normal response contains a two –byte status word, and a two–byte event count. The status word will be all ones (FF FF hex) if a previously–issued program command is still being processed by the remote device (a busy condition exists). Otherwise, the status word will be all zeros.
Request
Response
Error
12(0x0C) Get Comm Event Log (Serial Line only)
This function code is used to get a status word, event count, message count, and a field of event bytes from the remote device.The status word and event counts are identical to that returned by the Get Communications Event Counter function (11, 0B hex).
The message counter contains the quantity of messages processed by the remote device since its last restart, clear counters operation, or power –up. This count is identical to that returned by the Diagnostic function (code 08), sub -function Return Bus Message Count (code 11, 0B hex).
The event bytes field contains 0-64 bytes, with each byte corresponding to the status of one MODBUS send or receive operation for the remote device. The rem ote device enters the events into the field in chronological order. Byte 0 is the most recent event. Each new byte flushes the oldest byte from the field.
The normal response contains a two –byte status word field, a two–byte event count field, a two–byte message count field, and a field containing 0 -64 bytes of events. A byte count field defines the total length of the data in these four fields.
Request
Response
*N = Quantity of Events + 3 x 2 Bytes, (Length of Status, Event Count and Message Count)
Error
15(0x0F) Write Multiple Coils
This function code is used to force each coil in a sequence of coils to either ON or OFF in a remote device. The Request PDU specifies the coil references to be forced. Coils are addressed starting at zero. Therefore coil numbered 1 is addressed as 0.The requested ON/OFF states are specified by contents of the request data field. A logical ' 1' in a bit position of the field requests the corresponding output to be ON. A logical '0' requests it to be OFF.
The normal response returns the function code, starting address, and quantity of coils forced.
Request
N = Quantity of Outputs / 8, if the remainder is different of 0 N = N+1
Response
Error
16(0x10) Write Multiple registers
This function code is used to write a block of contiguous registers (1 to 123 registers) in a remote device.The requested written values are specified in the request data field. Data is packed as two bytes per register.
The normal response returns the function code, starting address, and quantity of registers written.
Request
*N = Quantity of registers
Response
Error
17(0x11) Report Server ID (Serial Line only)
This function code is used to read the description of the type, the current status, and other information specific to a remote device.The format of a normal response is shown in the following example. The data contents are specific to each type of device.
Request
Response
Error
20(0x14) Read File Record
This function code is used to perform a file record read. All Request Data Lengths are provided in terms of number of bytes and all Record Lengths are provided in terms of registers.A file is an organization of records. Each file contains 10000 records, addressed 0000 to 9999 decimal or 0X0000 to 0X270F. For example, record 12 is addressed as 12.
The function can read multiple groups of references. The groups can be separating (non - contiguous), but the references within each group must be sequential.
Each group is defined in a separate ‘sub-request’ field that contains 7 bytes:
- The reference type: 1 byte (must be specified as 6) The File number: 2 bytes
- The starting record number within the file: 2 bytes The length of the record to be read: 2 bytes.
- The quantity of registers to be read, combined with all other fields in the expected response, must not exceed the allowable length of the MODBUS PDU : 253 bytes.
- The normal response is a series of ‘sub-responses’, one for each ‘sub-request’. The byte count field is the total combined count of bytes in all ‘sub -responses’. In addition, each ‘sub-response’ contains a field that shows its own byte count.
Response
Error
21(0x15) Write File Record
This function code is used to perform a file record write. All Request Data Lengths are provided in terms of number of bytes and all Record Lengths are provided in terms of the number of 16-bit words.A file is an organization of records. Each file contains 10000 records, addressed 0000 to 9999 decimal or 0X0000 to 0X270F. For example, record 12 is addressed as 12.
The function can write multiple groups of references. The groups can be separate, i.e. n on– contiguous, but the references within each group must be sequential.
Each group is defined in a separate ‘sub-request’ field that contains 7 bytes plus the data:
The reference type: 1 byte (must be specified as 6) The file number: 2 bytes
The starting record number within the file: 2 bytes The length of the record to be written: 2 bytes The data to be written: 2 bytes per register.
The quantity of registers to be written, combined with all other fields in the request, must not exceed the allowable length of the MODBUS PDU : 253bytes.
The normal response is an echo of the request.
Request
Response
Error
22(0x16) Mask Write Register
This function code is used to modify the contents of a specified holding register using a combination of an AND mask, an OR mask, and the register's current contents. The function can be used to set or clear individual bits in the register.The request specifies the holding register to be written, the data to be used as the AND mask, and the data to be used as the OR mask. Registers are addressed starting at zero. Therefore registers 1-16 are addressed as 0-15.
The function’s algorithm is:
Result = (Current Contents AND And_Mask) OR (Or_Mask AND (NOT And_Mask))
Request
Response
Error
23(0x17) Read/Write Multiple Registers
This function code performs a combination of one read operation and one write operation in a single MODBUS transaction. The write operation is performed before the read.Holding registers are addressed starting at zero. Therefore holding registers 1 -16 are addressed in the PDU as 0-15.
The request specifies the starting address and number of holding registers to be read as well as the starting address, number of holding registers, and the data to be written. The byte count specifies the number of bytes to follow in the write data field.
The normal response contains the data from the group of registers that were read. The byte count field specifies the quantity of bytes to follow in the read data field.
Request
N = Quantity to Write
Response
*N' = Quantity to Read
Error
24(0x18) Read FIFO Queue
This function code allows to read the contents of a First-In-First-Out (FIFO) queue of register in a remote device. The function returns a count of the registers in the queue, followed by the queued data. Up to 32 registers can be read: the count, plus up to 31 queued data registers. The queue count register is returned first, followed by the queued data registers.The function reads the queue contents, but does not clear them.
In a normal response, the byte count shows the quantity of bytes to follow, including the queue count bytes and value register bytes (but not including the error check field).
The queue count is the quantity of data registers in the queue (not including the count register).
If the queue count exceeds 31, an exception response is returned with an error code of 03 (Illegal Data Value).
Request
Response
*N = FIFO count
Error