Modbus Frame Formats
Modbus serial communication acts as a client/server protocol. Only one client node is connected to the bus at any one time, and one or more (up to 247) server nodes are connected to the same serial bus. The client always initiates a Modbus communication. The server nodes do not send data to the client or any other server nodes unless they receive a request from a client.
MBPA Header | PDU | ||||
|---|---|---|---|---|---|
Transaction Identifier | Protocol identifier | Data length | Unit identifier/ address | Function Code | Data |
2 bytes | 2 bytes | 2 bytes | 1 byte | 1 byte | 2 bytes |
The MBPA header is defined as follows:
Segment name | Length | Description | Value |
|---|---|---|---|
Transaction identifier | 2 bytes | Generated by the client and copied by the server, used for transaction processing pairing. Generally, it can be set to 00 by default. | 0 |
Protocol identifier | 2 bytes | Modbus protocol = 0 | 0 |
Data length | 2 bytes | 1 = uni-te protocol, generated by client and copied by server. | Max 250 |
Unit identifier | 1 byte | Define the device linked to the destination node. It is generated by the client and copied by the server when responding. | — |
Modbus Function Codes Used
Serial Number | Function code | Description | Comments |
|---|---|---|---|
1 | 0x03 | Read the binary contents of holding registers in the server. | |
2 | 0x06 | Writes a value into a single holding register. | |
3 | 0x10 | Writes values into a sequence of holding registers |
Function Code 0x03
Read the binary contents of holding registers in the server.
Server Request format
Transaction ID | Protocol ID | Data length | Unit ID / Addr | Function code | Start address | Number of registers | ||
|---|---|---|---|---|---|---|---|---|
0x00 | 0x00 | 0x00 | 0x00 | 2 bytes | 0x01 | 0x03 | 2 bytes | 2 bytes |
Normal Client response
Transaction ID | Protocol ID | Data length | Unit ID / Addr | Function code | Start address | Number of registers | ||
|---|---|---|---|---|---|---|---|---|
0x00 | 0x00 | 0x00 | 0x00 | 2 bytes | 0x01 | 0x03 | 1 byte | N bytes |
Client Exception response
Transaction ID | Protocol ID | Data length | Unit ID / Addr | Function code + 0x80 | Error code | ||
|---|---|---|---|---|---|---|---|
0x00 | 0x00 | 0x00 | 0x00 | 2 bytes | 0x01 | 0x83 | 1 byte |
Data length = 2 * number of data registers to read
Function Code 0x06
Write a single holding register.
Server Request format
Transaction ID | Protocol ID | Data length | Unit ID / Addr | Function code | Start address | Number of registers | ||
|---|---|---|---|---|---|---|---|---|
0x00 | 0x00 | 0x00 | 0x00 | 2 bytes | 0x01 | 0x06 | 2 bytes | 2 bytes |
Normal Client response
Transaction ID | Protocol ID | Data length | Unit ID / Addr | Function code | Start address | Number of registers | ||
|---|---|---|---|---|---|---|---|---|
0x00 | 0x00 | 0x00 | 0x00 | 2 bytes | 0x01 | 0x06 | 1 byte | N bytes |
Client Exception response
Transaction ID | Protocol ID | Data length | Unit ID / Addr | Function code + 0x80 | Error code | ||
|---|---|---|---|---|---|---|---|
0x00 | 0x00 | 0x00 | 0x00 | 2 bytes | 0x01 | 0x86 | 1 byte |
Function Code 0x10
Write multiple, consecutive holding registers.
Server Request format
Transaction ID | Protocol ID | Data length | Unit ID / Addr | Function code | Registeraddress | Number of registers | Data length | Data | ||
|---|---|---|---|---|---|---|---|---|---|---|
0x00 | 0x00 | 0x00 | 0x00 | 2 bytes | 0x01 | 0x10 | 2 bytes | 2 bytes | 1 byte | N bytes |
Normal Client response
Transaction ID | Protocol ID | Data length | Unit ID / Addr | Function code | Start address | Data | ||
|---|---|---|---|---|---|---|---|---|
0x00 | 0x00 | 0x00 | 0x00 | 2 bytes | 0x01 | 0x10 | 2 bytes | 2 bytes |
Client Exception response
Transaction ID | Protocol ID | Data length | Unit ID / Addr | Function code + 0x80 | Error code | ||
|---|---|---|---|---|---|---|---|
0x00 | 0x00 | 0x00 | 0x00 | 2 bytes | 0x01 | 0x90 | 1 byte |
Error Codes
1 | Code_one | 0x01, invalid function code |
|---|---|---|
2 | Code_two | 0x02, invalid request address |
3 | Code_three | 0x03, invalid number of registers |
4 | Code_four | 0x04, failed to write register data |