Modbus Frame Formats
The serial Modbus protocol is based on master/slave principles. Only one master node is connected to the bus, and one or more (up to 247) slave nodes are connected to the same serial bus. Modbus communication is always initiated by the host. The slave nodes do not send data to the master or any other slave node unless requested by the master.
MBPA Header | PDU | ||||
|---|---|---|---|---|---|
Transaction | Protocol | Data length | Unit identifier/ | Function Code | Data |
2 bytes | 2 bytes | 2 bytes | 1 byte | 1 byte | N bytes |
MBPA Header
Segment Name | Length | Description | Value |
|---|---|---|---|
Transaction identifier | 2 bytes | Generated by the client and copied by the server, used for transaction processing pairing. Generally, can be set to 00 by default. | 0 |
Protocol | 2 bytes | Modbus protocol = 0 | 0 |
Data length | 2 bytes | 1 = uni-te protocol, generated by client and copied by server. | Max 250 |
Unit identifier | 1 byte | Define the device linked to the destination node. It is generated by the client and copied by the server when responding |
Modbus Function Codes Used
Serial Number | Function Code | Description |
|---|---|---|
1 | 0x03 | Read the binary contents of holding registers in the slave. |
2 | 0x06 | Writes a value into a single holding register. |
3 | 0x10 | Writes values into a sequence of holding registers. |
Modbus Response Packets
Function Code: 0x03
Read the binary contents of holding registers in the slave node.
Server Request Format
Transaction ID | Protocol ID | Data length | Unit ID / Address | Function code | Start address | Number of registers | ||
|---|---|---|---|---|---|---|---|---|
0x00 | 0x00 | 0x00 | 0x00 | 2 bytes | 0x01 | 0x03 | 2 bytes | 2 bytes |
Normal Client Response
Transaction ID | Protocol ID | Data length | Unit ID / Address | Function code | Start address | Data | ||
|---|---|---|---|---|---|---|---|---|
0x00 | 0x00 | 0x00 | 0x00 | 2 bytes | 0x01 | 0x03 | 1 byte | N bytes |
Client Exception Response
Transaction ID | Protocol ID | Data length | Unit ID / Address | Request function code + 0X80 | Error code | ||
|---|---|---|---|---|---|---|---|
0x00 | 0x00 | 0x00 | 0x00 | 2 bytes | 0x01 | 0x83 | 1 byte |
Function Code: 0x06
Write a single holding register.
Server Request Format
Transaction ID | Protocol ID | Data length | Unit ID / Address | Function code | Register address | Register value | ||
|---|---|---|---|---|---|---|---|---|
0x00 | 0x00 | 0x00 | 0x00 | 2 bytes | 0x01 | 0x06 | 2 bytes | 2 bytes |
Normal Client Response
Transaction ID | Protocol ID | Data length | Unit ID / Address | Function code | Register address | Register value | ||
|---|---|---|---|---|---|---|---|---|
0x00 | 0x00 | 0x00 | 0x00 | 2 bytes | 0x01 | 0x06 | 2 bytes | 2 bytes |
Client Exception Response
Transaction ID | Protocol ID | Data length | Unit ID / Address | Request function code + 0X80 | Error code | ||
|---|---|---|---|---|---|---|---|
0x00 | 0x00 | 0x00 | 0x00 | 2 bytes | 0x01 | 0x86 | 1 byte |
Function Code: 0x10
Write multiple, consecutive holding registers.
Server Request Format
Transaction ID | Protocol ID | Data length | Unit ID / Addr | Function code | Register address | Num of registers | Data length | Data | ||
|---|---|---|---|---|---|---|---|---|---|---|
0x00 | 0x00 | 0x00 | 0x00 | 2 bytes | 0x01 | 0x10 | 2 bytes | 2 bytes | 1 byte | N bytes |
Normal Client Response (BMS reply)
Transaction ID | Protocol ID | Data length | Unit ID / Address | Function code | Start address | Data | ||
|---|---|---|---|---|---|---|---|---|
0x00 | 0x00 | 0x00 | 0x00 | 2 bytes | 0x01 | 0x10 | 2 byte | 2 bytes |
Client Exception Response
Transaction ID | Protocol ID | Data length | Unit ID / Address | Request function code + 0X80 | Error code | ||
|---|---|---|---|---|---|---|---|
0x00 | 0x00 | 0x00 | 0x00 | 2 bytes | 0x01 | 0x90 | 1 byte |
Error Codes
Code_ one: 0x01, invalid function code
Code_ two: 0x02, invalid request address
Code_ three: 0x03, invalid number of registers
Code_ four: 0x04, failed to write register data