Modbus Protocol Reference
Technical reference guide for Modbus RTU and Modbus TCP protocols with function codes, data frames, and examples.
Modbus Protocol Reference Guide
Modbus is a serial communication protocol widely used for connecting industrial electronic devices. This reference provides technical details for implementation.
Protocol Variants
Modbus RTU
Serial communication (RS-232, RS-485)
Binary encoding
CRC error checking
Master-slave architecture
Modbus TCP
Ethernet/IP communication
Port 502 (default)
Client-server architecture
No CRC (uses TCP checksum)
Function Codes
Code | Function | Description |
|---|---|---|
| Read Coils | Read multiple coil status (1-2000) |
| Read Discrete Inputs | Read multiple discrete input status (1-2000) |
| Read Holding Registers | Read multiple holding registers (1-125) |
| Read Input Registers | Read multiple input registers (1-125) |
| Write Single Coil | Write single coil ON/OFF |
| Write Single Register | Write single holding register |
| Write Multiple Coils | Write multiple coils (1-1968) |
| Write Multiple Registers | Write multiple holding registers (1-123) |

Figure 3: Modbus Protocol Stack
Data Frame Structure
Modbus RTU Frame
[Device Address][Function Code][Data][CRC-16]Device Address: 1 byte (1-247)
Function Code: 1 byte
Data: Variable length
CRC: 2 bytes
Modbus TCP Frame
[MBAP Header][Function Code][Data]MBAP Header: 7 bytes
Transaction ID: 2 bytes
Protocol ID: 2 bytes (0x0000)
Length: 2 bytes
Unit ID: 1 byte
Function Code: 1 byte
Data: Variable length
Error Codes
Code | Name | Meaning |
|---|---|---|
| Illegal Function | Function code not supported |
| Illegal Data Address | Address not available |
| Illegal Data Value | Value not allowed |
| Slave Device Failure | Device error occurred |
Implementation Example
Reading holding registers (Function Code 03):
// Request Frame
Device Address: 0x01
Function Code: 0x03
Starting Address: 0x0000 (Register 0)
Quantity: 0x0002 (2 registers)
CRC: 0xC40B
// Response Frame
Device Address: 0x01
Function Code: 0x03
Byte Count: 0x04 (4 bytes = 2 registers)
Register 0: 0x0A0B
Register 1: 0x0C0D
CRC: 0x9E49
