Modbus Protocol 4 — Function Codes (Part 2)

Continuing from the previous introduction of function codes,

Function Code 02

Function Code 02 indicates reading the status of discrete inputs.

Request Message Format

Function Code (1 Byte) Starting Address (2 Bytes) Quantity (2 Bytes)
0x02 0x0000 – 0xFFFF 1 – 2000

Normal Response Message Format

Function Code (1 Byte) Byte Count (1 Byte) Discrete Input (n Bytes)
0x02 n n bytes of data

Each bit of the response data represents a discrete input. If reading N discrete inputs, the number of bytes returned in the response message will be (N+7)/8.

Error Response Message Format

Function Code (1 Byte) Error Code (1 Byte)
0x02 + 0x80 1, 2, 3, or 4

Example Explanation

  • Request Message:<span>02 00 06 00 12</span>

    • 02: Function Code
    • 00 06: Starting address of the discrete input to read 0x0006
    • 00 12: Number of discrete inputs to read 0x0012

  • Response Message:<span>02 03 11 22 03</span>

    • 02: Function Code
    • 03: There are 3 bytes of discrete input status values
    • 11 22 03: Discrete input status values, data 11’s bit0 represents the status of input 7 (since the starting address to read is 0x0006, the 7th input), bit1 represents the status of input 8, and so on.

Function Code 03

Function Code 03 indicates reading the values of holding registers.

Request Message Format

Function Code (1 Byte) Starting Address (2 Bytes) Quantity (2 Bytes)
0x03 0x0000 – 0xFFFF 1 – 125

Normal Response Message Format

Function Code (1 Byte) Byte Count (1 Byte) Register Value (n Bytes)
0x03 n n bytes of data

Each register is 2 bytes, so when reading N registers, the number of response bytes n=N*2.

Error Response Message Format

Function Code (1 Byte) Error Code (1 Byte)
0x03 + 0x80 1, 2, 3, or 4

Example Explanation

  • Request Message:<span>03 00 02 00 03</span>

    • 03: Function Code
    • 00 02: Starting address of the holding register to read 0x0002
    • 00 03: Number of holding registers to read 0x0003

  • Response Message:<span>03 06 11 22 33 44 55 66</span>

    • 03: Function Code
    • 06: There are 6 bytes of response holding register values
    • 11 22: Value of register 0x0002, value is 0x1122
    • 33 44: Value of register 0x0003, value is 0x3344
    • 55 66: Value of register 0x0004, value is 0x5566

Function Code 04

Function Code 04 indicates reading the values of input registers.

Request Message Format

Function Code (1 Byte) Starting Address (2 Bytes) Quantity (2 Bytes)
0x04 0x0000 – 0xFFFF 1 – 125

Normal Response Message Format

Function Code (1 Byte) Byte Count (1 Byte) Register Value (n Bytes)
0x04 n n bytes of data

Each register is 2 bytes, so when reading N registers, the number of response bytes n=N*2.

Error Response Message Format

Function Code (1 Byte) Error Code (1 Byte)
0x04 + 0x80 1, 2, 3, or 4

Example Explanation

  • Request Message:<span>04 00 06 00 02</span>

    • 04: Function Code
    • 00 06: Starting address of the holding register to read 0x0006
    • 00 02: Number of holding registers to read 0x0002

  • Response Message:<span>04 04 11 22 33 44</span>

    • 04: Function Code
    • 04: There are 4 bytes of response input register values
    • 11 22: Value of register 0x0006, value is 0x1122
    • 33 44: Value of register 0x0007, value is 0x3344

Function Code 05

Function Code 05 indicates setting the value of a single coil.

Request Message Format

Function Code (1 Byte) Starting Address (2 Bytes) Quantity (2 Bytes)
0x05 0x0000 – 0xFFFF 0x0000 or 0xFF00

Normal Response Message Format

Function Code (1 Byte) Byte Count (2 Bytes) Response Value (2 Bytes)
0x05 Set Address 0x0000 or 0xFF00

0x0000 indicates releasing the relay, 0xFF00 indicates engaging the relay

Error Response Message Format

Function Code (1 Byte) Error Code (1 Byte)
0x05 + 0x80 1, 2, 3, or 4

Example Explanation

  • Request Message:<span>05 00 12 FF 00</span>

    • 05: Function Code
    • 00 12: Set the status of the 19th coil
    • FF 00: Set the coil status to engage

  • Response Message:<span>05 00 12 FF 00</span>

    • 05: Function Code
    • 00 12: The set coil is the 19th
    • FF 00: The set coil status is engage

Function Code 06

Function Code 06 indicates setting the value of a single holding register.

Request Message Format

Function Code (1 Byte) Starting Address (2 Bytes) Set Value (2 Bytes)
0x06 0x0000 – 0xFFFF 0x0000 – 0xFFFF

Normal Response Message Format

Function Code (1 Byte) Set Address (2 Bytes) Set Value (2 Bytes)
0x06 Requested Address Requested Set Value

Error Response Message Format

Function Code (1 Byte) Error Code (1 Byte)
0x06 + 0x80 1, 2, 3, or 4

Example Explanation

  • Request Message:<span>06 00 07 12 34</span>

    • 06: Function Code
    • 00 07: Set the value of holding register 0x0007
    • 12 34: Set value to 0x1234

  • Response Message:<span>06 00 07 12 34</span>

    • 06: Function Code
    • 00 07: The set holding register address is 0x0007
    • 12 34: The set value is 0x1234

Function Code 15

Function Code 15 indicates setting the values of multiple coils.

Request Message Format

Function Code (1 Byte) Starting Address (2 Bytes) Number of Coils (2 Bytes) Byte Count (1 Byte) Coil Values (n Bytes)
0x0F 0x0000 – 0xFFFF 0x0000 – 0x7B0 n bytes Coil status values

Each bit of the coil status value represents a coil status. If setting N coils, the number of bytes in the message n=(N+7)/8.

Normal Response Message Format

Function Code (1 Byte) Starting Address (2 Bytes) Number of Coils (2 Bytes)
0x0F Requested Address Requested Number of Coils

Error Response Message Format

Function Code (1 Byte) Error Code (1 Byte)
0x0F + 0x80 1, 2, 3, or 4

Example Explanation

  • Request Message:<span>0F 00 06 00 09 02 11 01</span>

    • 0F: Function Code
    • 00 06: Starting address of the coils to set
    • 00 09: Set values for 9 coils
    • 02: Coil status value is 2 bytes
    • 11 01: Set coil status values, 0x11 corresponds to coils 13-6, 0x01’s bit0 corresponds to coil 14

  • Response Message:<span>0F 00 06 00 09</span>

    • 0F: Function Code
    • 00 06: Starting address of the coils to set
    • 00 09: Set values for 9 coils

Function Code 16

Function Code 16 indicates setting the values of multiple holding registers.

Request Message Format

Function Code (1 Byte) Starting Address (2 Bytes) Number of Holding Registers (2 Bytes) Byte Count (1 Byte) Holding Register Values (n Bytes)
0x10 0x0000 – 0xFFFF 0x0000 – 0x7B0 n=N*2 N holding register values

If the number of holding registers to set is N, then the number of bytes in the message n=N*2.

Normal Response Message Format

Function Code (1 Byte) Starting Address (2 Bytes) Number of Holding Registers (2 Bytes)
0x10 Requested Address Requested Number of Holding Registers

Error Response Message Format

Function Code (1 Byte) Error Code (1 Byte)
0x10 + 0x80 1, 2, 3, or 4

Example Explanation

  • Request Message:<span>10 00 02 00 03 06 11 22 33 44 55 66</span>

    • 10: Function Code
    • 00 02: Starting address of the holding registers to set
    • 00 03: Set values for 3 holding registers
    • 06: 3 holding registers have 6 bytes
    • 11 22: Set the value of holding register 0x0002 to 0x1122
    • 33 44: Set the value of holding register 0x0003 to 0x3344
    • 55 66: Set the value of holding register 0x0004 to 0x5566

  • Response Message:<span>10 00 02 00 03</span>

    • 10: Function Code
    • 00 02: Starting address of the holding registers to set
    • 00 03: Set values for 3 holding registers

Related posts

  1. Makefile Practical Guide: Start from Scratch for Effortless Code Compilation
  2. Quick Reference and Scenario Analysis of HTTP Status Codes
  3. GDB Debugging Method (5) – Debugging Dynamic Libraries
  4. Discussing C Programming – Address Manipulation and Byte Control in C Language
  5. Efficient Use of PyPDF4: A Python Library for PDF File Processing!
  6. Introduction to Modbus Protocol: A Comprehensive Guide
  7. Debugging Methods and Techniques for ATF Architecture 3.4 (GDB, JTAG, Logging System)
  8. Rust Powerhouse Strikes: Python Developers Are Amazed!
  9. Communication Case Between S7-1200 and Modbus Gateway
  10. In-Depth Analysis of the 18V Camera PMIC SC6201Q: 3 Buck + 1 LDO
  11. Tesla Bets on Robots, OpenAI Builds Supercomputing Center, Alibaba Develops AI Chips | Frontline News
  12. OkHttp: The Eagle of Network Requests
  13. Comprehensive Analysis of MQTT Servers
  14. Offline Development Platform – Demonstration of HTTP Data Synchronization to Doris Data Warehouse Capability
  15. How to Fix Python Script Crashing on Double Click: Three Steps and Detailed Explanation
  16. Understanding MQTT Topics
  17. Understanding Recent Changes to HTTP+SSE by MCP: Streamable HTTP
  18. Essential Guide! Capturing HTTP MP4 Media Streams with Wireshark: From Traffic Capture to Content Parsing, Accessible for Beginners
  19. Interpreting MediaTek’s Wi-Fi 8 White Paper Part One

Leave a Comment