Modbus Protocol Reference - Complete Technical Guide

Modbus Protocol Reference Guide

Modbus is a serial communication protocol widely used for connecting industrial electronic devices. This reference provides technical details for implementation.

Protocol Variants

Modbus RTU

Serial communication (RS-232, RS-485)
Binary encoding
CRC error checking
Master-slave architecture

Modbus TCP

Ethernet/IP communication
Port 502 (default)
Client-server architecture
No CRC (uses TCP checksum)

Function Codes

Code	Function	Description
`01`	Read Coils	Read multiple coil status (1-2000)
`02`	Read Discrete Inputs	Read multiple discrete input status (1-2000)
`03`	Read Holding Registers	Read multiple holding registers (1-125)
`04`	Read Input Registers	Read multiple input registers (1-125)
`05`	Write Single Coil	Write single coil ON/OFF
`06`	Write Single Register	Write single holding register
`15`	Write Multiple Coils	Write multiple coils (1-1968)
`16`	Write Multiple Registers	Write multiple holding registers (1-123)

Figure 3: Modbus Protocol Stack

Data Frame Structure

Modbus RTU Frame

[Device Address][Function Code][Data][CRC-16]

Device Address: 1 byte (1-247)
Function Code: 1 byte
Data: Variable length
CRC: 2 bytes

Modbus TCP Frame

[MBAP Header][Function Code][Data]

MBAP Header: 7 bytes
- Transaction ID: 2 bytes
- Protocol ID: 2 bytes (0x0000)
- Length: 2 bytes
- Unit ID: 1 byte
Function Code: 1 byte
Data: Variable length

Error Codes

Code	Name	Meaning
`01`	Illegal Function	Function code not supported
`02`	Illegal Data Address	Address not available
`03`	Illegal Data Value	Value not allowed
`04`	Slave Device Failure	Device error occurred

Implementation Example

Reading holding registers (Function Code 03):

// Request Frame
Device Address: 0x01
Function Code: 0x03
Starting Address: 0x0000 (Register 0)
Quantity: 0x0002 (2 registers)
CRC: 0xC40B

// Response Frame
Device Address: 0x01
Function Code: 0x03
Byte Count: 0x04 (4 bytes = 2 registers)
Register 0: 0x0A0B
Register 1: 0x0C0D
CRC: 0x9E49